| Message ID | 1420566495-13284-6-git-send-email-peter@lekensteyn.nl |
|---|---|
| State | New |
| Headers | show |
On 01/06/2015 12:48 PM, Peter Wu wrote: > Previously the chunk size was not checked, allowing for a large memory > allocation. This patch checks whether the chunks size is within the > resource fork length, and whether the resource fork is below the > trailer of the dmg file. > > Signed-off-by: Peter Wu <peter@lekensteyn.nl> > --- > v2: added resource fork offset check > --- > block/dmg.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > > diff --git a/block/dmg.c b/block/dmg.c > index 4913249..5f6976b 100644 > --- a/block/dmg.c > +++ b/block/dmg.c > @@ -319,7 +319,7 @@ static int dmg_read_resource_fork(BlockDriverState *bs, DmgHeaderState *ds, > ret = read_uint32(bs, offset, &count); > if (ret < 0) { > goto fail; > - } else if (count == 0) { > + } else if (count == 0 || count > info_end - offset) { > ret = -EINVAL; > goto fail; > } > @@ -379,6 +379,11 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags, > if (ret < 0) { > goto fail; > } > + if (rsrc_fork_offset >= offset || > + rsrc_fork_length > offset - rsrc_fork_offset) { > + ret = -EINVAL; > + goto fail; > + } > if (rsrc_fork_length != 0) { > ret = dmg_read_resource_fork(bs, &ds, > rsrc_fork_offset, rsrc_fork_length); > Reviewed-by: John Snow <jsnow@redhat.com>
diff --git a/block/dmg.c b/block/dmg.c index 4913249..5f6976b 100644 --- a/block/dmg.c +++ b/block/dmg.c @@ -319,7 +319,7 @@ static int dmg_read_resource_fork(BlockDriverState *bs, DmgHeaderState *ds, ret = read_uint32(bs, offset, &count); if (ret < 0) { goto fail; - } else if (count == 0) { + } else if (count == 0 || count > info_end - offset) { ret = -EINVAL; goto fail; } @@ -379,6 +379,11 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags, if (ret < 0) { goto fail; } + if (rsrc_fork_offset >= offset || + rsrc_fork_length > offset - rsrc_fork_offset) { + ret = -EINVAL; + goto fail; + } if (rsrc_fork_length != 0) { ret = dmg_read_resource_fork(bs, &ds, rsrc_fork_offset, rsrc_fork_length);
Previously the chunk size was not checked, allowing for a large memory allocation. This patch checks whether the chunks size is within the resource fork length, and whether the resource fork is below the trailer of the dmg file. Signed-off-by: Peter Wu <peter@lekensteyn.nl> --- v2: added resource fork offset check --- block/dmg.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)