From 0299fe4ab88515eed3938d6b079d6b438e2be72e Mon Sep 17 00:00:00 2001 Message-Id: <0299fe4ab88515eed3938d6b079d6b438e2be72e.1376387172.git.minovotn@redhat.com> In-Reply-To: References: From: Fam Zheng Date: Thu, 8 Aug 2013 06:09:37 +0200 Subject: [PATCH 07/13] vmdk: check l2 table size when opening RH-Author: Fam Zheng Message-id: <1375942181-5262-8-git-send-email-famz@redhat.com> Patchwork-id: 53072 O-Subject: [RHEL-6.5 qemu-kvm PATCH 07/11] vmdk: check l2 table size when opening Bugzilla: 994804 RH-Acked-by: Kevin Wolf RH-Acked-by: Stefan Hajnoczi RH-Acked-by: Jeffrey Cody header.num_gtes_per_gte determines size for L2 table. Check for too big value before using it. Limit to 512M entries (2GB per one L2 table). Signed-off-by: Fam Zheng Signed-off-by: Kevin Wolf (cherry picked from commit f8ce04036e333aae480b1d06d969f6436652633d) Signed-off-by: Fam Zheng Conflicts: tests/qemu-iotests/059 tests/qemu-iotests/059.out Manually remove test script from commit Signed-off-by: Fam Zheng --- block/vmdk.c | 5 +++++ 1 file changed, 5 insertions(+) Signed-off-by: Michal Novotny --- block/vmdk.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/block/vmdk.c b/block/vmdk.c index 8744780..4bdc315 100644 --- a/block/vmdk.c +++ b/block/vmdk.c @@ -583,6 +583,11 @@ static int vmdk_open_vmdk4(BlockDriverState *bs, return -ENOTSUP; } + if (le32_to_cpu(header.num_gtes_per_gte) > 512) { + error_report("L2 table size too big"); + return -EINVAL; + } + l1_entry_sectors = le32_to_cpu(header.num_gtes_per_gte) * le64_to_cpu(header.granularity); if (l1_entry_sectors == 0) { -- 1.7.11.7