Commit 5dab2fad authored by Kevin Wolf's avatar Kevin Wolf Committed by Stefan Hajnoczi
Browse files

qcow2: Check refcount table size (CVE-2014-0144) 



Limit the in-memory reference count table size to 8 MB, it's enough in
practice. This fixes an unbounded allocation as well as a buffer
overflow in qcow2_refcount_init().

Signed-off-by: default avatarKevin Wolf <kwolf@redhat.com>
Reviewed-by: default avatarMax Reitz <mreitz@redhat.com>
Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
parent a1b3955c

block/qcow2-refcount.c

+3 −1
Original line number Diff line number Diff line
@@ -40,8 +40,10 @@ static int QEMU_WARN_UNUSED_RESULT update_refcount(BlockDriverState *bs, 
int qcow2_refcount_init(BlockDriverState *bs)

{

    BDRVQcowState *s = bs->opaque;

    int ret, refcount_table_size2, i;

    unsigned int refcount_table_size2, i;

    int ret;



    assert(s->refcount_table_size <= INT_MAX / sizeof(uint64_t));

    refcount_table_size2 = s->refcount_table_size * sizeof(uint64_t);

    s->refcount_table = g_malloc(refcount_table_size2);

    if (s->refcount_table_size > 0) {

block/qcow2.c

+9 −0
Original line number Diff line number Diff line
@@ -577,10 +577,19 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags, 
    s->csize_shift = (62 - (s->cluster_bits - 8));

    s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;

    s->cluster_offset_mask = (1LL << s->csize_shift) - 1;



    s->refcount_table_offset = header.refcount_table_offset;

    s->refcount_table_size =

        header.refcount_table_clusters << (s->cluster_bits - 3);



    if (header.refcount_table_clusters > (0x800000 >> s->cluster_bits)) {

        /* 8 MB refcount table is enough for 2 PB images at 64k cluster size

         * (128 GB for 512 byte clusters, 2 EB for 2 MB clusters) */

        error_setg(errp, "Reference count table too large");

        ret = -EINVAL;

        goto fail;

    }



    s->snapshots_offset = header.snapshots_offset;

    s->nb_snapshots = header.nb_snapshots;

tests/qemu-iotests/080

+10 −0
Original line number Diff line number Diff line
@@ -45,6 +45,7 @@ _supported_os Linux 
header_size=104



offset_backing_file_offset=8

offset_refcount_table_clusters=56

offset_header_size=100

offset_ext_magic=$header_size

offset_ext_size=$((header_size + 4))
@@ -67,6 +68,15 @@ poke_file "$TEST_IMG" "$offset_ext_size" "\x7f\xff\xff\xff" 
poke_file "$TEST_IMG" "$offset_backing_file_offset" "\x00\x00\x00\x00\x00\x00\x00\x00"

{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir



echo

echo "== Huge refcount table size =="

_make_test_img 64M

poke_file "$TEST_IMG" "$offset_refcount_table_clusters" "\xff\xff\xff\xff"

{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir

poke_file "$TEST_IMG" "$offset_refcount_table_clusters" "\x00\x02\x00\x01"

{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir





# success, all done

echo "*** done"

rm -f $seq.full

tests/qemu-iotests/080.out

+7 −0
Original line number Diff line number Diff line
@@ -13,4 +13,11 @@ qemu-io: can't open device TEST_DIR/t.qcow2: Invalid backing file offset 
no file open, try 'help open'

qemu-io: can't open device TEST_DIR/t.qcow2: Header extension too large

no file open, try 'help open'



== Huge refcount table size ==

Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 

qemu-io: can't open device TEST_DIR/t.qcow2: Reference count table too large

no file open, try 'help open'

qemu-io: can't open device TEST_DIR/t.qcow2: Reference count table too large

no file open, try 'help open'

*** done