aboutsummaryrefslogtreecommitdiff
path: root/tests/qemu-iotests/sample_images
diff options
context:
space:
mode:
authorKevin Wolf <kwolf@redhat.com>2014-03-26 13:06:08 +0100
committerStefan Hajnoczi <stefanha@redhat.com>2014-04-01 15:22:35 +0200
commitafbcc40bee4ef51731102d7d4b499ee12fc182e1 (patch)
tree35f637ffc51bffdf6a01dd6478ccae2a0a2bcb1e /tests/qemu-iotests/sample_images
parent5dae6e30c531feb31eed99f9039b52bf70832ce3 (diff)
parallels: Fix catalog size integer overflow (CVE-2014-0143)
The first test case would cause a huge memory allocation, leading to a qemu abort; the second one to a too small malloc() for the catalog (smaller than s->catalog_size), which causes a read-only out-of-bounds array access and on big endian hosts an endianess conversion for an undefined memory area. The sample image used here is not an original Parallels image. It was created using an hexeditor on the basis of the struct that qemu uses. Good enough for trying to crash the driver, but not for ensuring compatibility. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'tests/qemu-iotests/sample_images')
-rw-r--r--tests/qemu-iotests/sample_images/fake.parallels.bz2bin0 -> 141 bytes
1 files changed, 0 insertions, 0 deletions
diff --git a/tests/qemu-iotests/sample_images/fake.parallels.bz2 b/tests/qemu-iotests/sample_images/fake.parallels.bz2
new file mode 100644
index 0000000000..ffb5f13bac
--- /dev/null
+++ b/tests/qemu-iotests/sample_images/fake.parallels.bz2
Binary files differ