@@ -585,6 +585,11 @@ static int vmdk_open_vmdk4(BlockDriverState *bs,
return -ENOTSUP;
}
+ if (le32_to_cpu(header.num_gtes_per_gte) > 512) {
+ error_report("L2 table size too big");
+ return -EINVAL;
+ }
+
l1_entry_sectors = le32_to_cpu(header.num_gtes_per_gte)
* le64_to_cpu(header.granularity);
if (l1_entry_sectors == 0) {
@@ -44,6 +44,7 @@ _supported_proto generic
_supported_os Linux
granularity_offset=20
+grain_table_size_offset=44
echo "=== Testing invalid granularity ==="
echo
@@ -51,6 +52,12 @@ _make_test_img 64M
poke_file "$TEST_IMG" "$granularity_offset" "\xff\xff\xff\xff\xff\xff\xff\xff"
{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
+echo "=== Testing too big L2 table size ==="
+echo
+_make_test_img 64M
+poke_file "$TEST_IMG" "$grain_table_size_offset" "\xff\xff\xff\xff"
+{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
+
# success, all done
echo "*** done"
rm -f $seq.full
@@ -5,4 +5,10 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
invalid granularity, image may be corrupt
qemu-io: can't open device TEST_DIR/t.vmdk
no file open, try 'help open'
+=== Testing too big L2 table size ===
+
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
+L2 table size too big
+qemu-io: can't open device TEST_DIR/t.vmdk
+no file open, try 'help open'
*** done