diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2014-05-15 16:10:11 +0200 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2014-05-19 11:36:49 +0200 |
| commit | 42eb58179b3b215bb507da3262b682b8a2ec10b5 (patch) | |
| tree | 5dd3e16d510ab10ee3d2c2aa843daa44ed34f25c /tests/qemu-iotests/092 | |
| parent | 7159a45b2bf2dcb9f49f1e27d1d3d135a0247a2f (diff) | |
qcow1: Validate L2 table size (CVE-2014-0222)
Too large L2 table sizes cause unbounded allocations. Images actually
created by qemu-img only have 512 byte or 4k L2 tables.
To keep things consistent with cluster sizes, allow ranges between 512
bytes and 64k (in fact, down to 1 entry = 8 bytes is technically
working, but L2 table sizes smaller than a cluster don't make a lot of
sense).
This also means that the number of bytes on the virtual disk that are
described by the same L2 table is limited to at most 8k * 64k or 2^29,
preventively avoiding any integer overflows.
Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Diffstat (limited to 'tests/qemu-iotests/092')
| -rwxr-xr-x | tests/qemu-iotests/092 | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/tests/qemu-iotests/092 b/tests/qemu-iotests/092 index d060e6fa87..fb8bacc58c 100755 --- a/tests/qemu-iotests/092 +++ b/tests/qemu-iotests/092 @@ -44,6 +44,7 @@ _supported_proto generic _supported_os Linux offset_cluster_bits=32 +offset_l2_bits=33 echo echo "== Invalid cluster size ==" @@ -57,6 +58,20 @@ poke_file "$TEST_IMG" "$offset_cluster_bits" "\x08" poke_file "$TEST_IMG" "$offset_cluster_bits" "\x11" { $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir +echo +echo "== Invalid L2 table size ==" +_make_test_img 64M +poke_file "$TEST_IMG" "$offset_l2_bits" "\xff" +{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir +poke_file "$TEST_IMG" "$offset_l2_bits" "\x05" +{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir +poke_file "$TEST_IMG" "$offset_l2_bits" "\x0e" +{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir + +# 1 << 0x1b = 2^31 / L2_CACHE_SIZE +poke_file "$TEST_IMG" "$offset_l2_bits" "\x1b" +{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir + # success, all done echo "*** done" rm -f $seq.full |