diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2014-03-26 13:06:02 +0100 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2014-07-03 16:18:13 -0500 |
| commit | 759d38652ae6bbe1253b921c13c43d2c6c25b8d5 (patch) | |
| tree | bd83c7d71c75b85acaf292193074d7239cdc0428 /docs/writing-qmp-commands.txt | |
| parent | b6f7fbdd1d9e27822e829e983fb6f907576a24e4 (diff) | |
block: Limit request size (CVE-2014-0143)
Limiting the size of a single request to INT_MAX not only fixes a
direct integer overflow in bdrv_check_request() (which would only
trigger bad behaviour with ridiculously huge images, as in close to
2^64 bytes), but can also prevent overflows in all block drivers.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 8f4754ede56e3f9ea3fd7207f4a7c4453e59285b)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'docs/writing-qmp-commands.txt')
0 files changed, 0 insertions, 0 deletions