tree 3d7bdb3799feee94728a37374a26349d46e7b227
parent 42eb58179b3b215bb507da3262b682b8a2ec10b5
author Kevin Wolf <kwolf@redhat.com> 1399547300 +0200
committer Kevin Wolf <kwolf@redhat.com> 1400492209 +0200

qcow1: Validate image size (CVE-2014-0223)

A huge image size could cause s->l1_size to overflow. Make sure that
images never require a L1 table larger than what fits in s->l1_size.

This cannot only cause unbounded allocations, but also the allocation of
a too small L1 table, resulting in out-of-bounds array accesses (both
reads and writes).

Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>