Commit e3737b82 authored by Kevin Wolf's avatar Kevin Wolf Committed by Stefan Hajnoczi
Browse files

bochs: Check catalog_size header field (CVE-2014-0143) 



It should neither become negative nor allow unbounded memory
allocations. This fixes aborts in g_malloc() and an s->catalog_bitmap
buffer overflow on big endian hosts.

Signed-off-by: default avatarKevin Wolf <kwolf@redhat.com>
Reviewed-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: default avatarMax Reitz <mreitz@redhat.com>
Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
parent 246f6583

block/bochs.c

+13 −0
Original line number Diff line number Diff line
@@ -123,7 +123,14 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags, 
        bs->total_sectors = le64_to_cpu(bochs.extra.redolog.disk) / 512;

    }



    /* Limit to 1M entries to avoid unbounded allocation. This is what is

     * needed for the largest image that bximage can create (~8 TB). */

    s->catalog_size = le32_to_cpu(bochs.catalog);

    if (s->catalog_size > 0x100000) {

        error_setg(errp, "Catalog size is too large");

        return -EFBIG;

    }



    s->catalog_bitmap = g_malloc(s->catalog_size * 4);



    ret = bdrv_pread(bs->file, le32_to_cpu(bochs.header), s->catalog_bitmap,
@@ -142,6 +149,12 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags, 


    s->extent_size = le32_to_cpu(bochs.extent);



    if (s->catalog_size < bs->total_sectors / s->extent_size) {

        error_setg(errp, "Catalog size is too small for this disk size");

        ret = -EINVAL;

        goto fail;

    }



    qemu_co_mutex_init(&s->lock);

    return 0;

tests/qemu-iotests/078

+13 −0
Original line number Diff line number Diff line
@@ -43,6 +43,7 @@ _supported_proto generic 
_supported_os Linux



catalog_size_offset=$((0x48))

disk_size_offset=$((0x58))



echo

echo "== Read from a valid image =="
@@ -55,6 +56,18 @@ _use_sample_img empty.bochs.bz2 
poke_file "$TEST_IMG" "$catalog_size_offset" "\xff\xff\xff\xff"

{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir



echo

echo "== Overflow for catalog size * sizeof(uint32_t) =="

_use_sample_img empty.bochs.bz2

poke_file "$TEST_IMG" "$catalog_size_offset" "\x00\x00\x00\x40"

{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir



echo

echo "== Too small catalog bitmap for image size =="

_use_sample_img empty.bochs.bz2

poke_file "$TEST_IMG" "$disk_size_offset" "\x00\xc0\x0f\x00\x00\x00\x00\x7f"

{ $QEMU_IO -c "read 2T 4k" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir



# success, all done

echo "*** done"

rm -f $seq.full

tests/qemu-iotests/078.out

+9 −1
Original line number Diff line number Diff line
@@ -5,6 +5,14 @@ read 512/512 bytes at offset 0 
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)



== Negative catalog size ==

qemu-io: can't open device TEST_DIR/empty.bochs: Could not open 'TEST_DIR/empty.bochs': Interrupted system call

qemu-io: can't open device TEST_DIR/empty.bochs: Catalog size is too large

no file open, try 'help open'



== Overflow for catalog size * sizeof(uint32_t) ==

qemu-io: can't open device TEST_DIR/empty.bochs: Catalog size is too large

no file open, try 'help open'



== Too small catalog bitmap for image size ==

qemu-io: can't open device TEST_DIR/empty.bochs: Catalog size is too small for this disk size

no file open, try 'help open'

*** done