Jeff Cody 1d7678dec4 vhdx: Bounds checking for block_size and logical_sector_size (CVE-2014-0148) ...

Other variables (e.g. sectors_per_block) are calculated using these
variables, and if not range-checked illegal values could be obtained
causing infinite loops and other potential issues when calculating
BAT entries.

The 1.00 VHDX spec requires BlockSize to be min 1MB, max 256MB.
LogicalSectorSize is required to be either 512 or 4096 bytes.

Reported-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

2014-04-01 14:19:09 +02:00

..

backup.c

…

blkdebug.c

block: Remove bdrv_open_image()'s force_raw option

2014-02-21 21:02:22 +01:00

blkverify.c

block: Rewrite the snapshot authorization mechanism for block filters.

2014-03-13 14:23:27 +01:00

bochs.c

bochs: Fix bitmap offset calculation

2014-04-01 13:59:47 +02:00

cloop.c

block/cloop: fix offsets[] size off-by-one

2014-04-01 13:59:47 +02:00

commit.c

…

cow.c

block: do not abuse EMEDIUMTYPE

2014-02-21 21:02:24 +01:00

curl.c

curl: correctly propagate errors

2014-02-21 21:02:23 +01:00

dmg.c

…

gluster.c

Fixed various typos

2014-03-25 14:09:50 +01:00

iscsi.c

iscsi: Use bs->sg for everything else than disks

2014-03-05 16:58:20 +01:00

linux-aio.c

…

Makefile.objs

Block patches

2014-02-25 10:50:11 +00:00

mirror.c

mirror: fix early wake from sleep due to aio

2014-03-25 14:09:50 +01:00

nbd-client.c

nbd: close socket if connection breaks

2014-03-14 16:28:28 +01:00

nbd-client.h

…

nbd.c

nbd: correctly propagate errors

2014-02-21 21:02:22 +01:00

nfs.c

block/nfs: report errors from libnfs

2014-03-19 09:39:41 +01:00

parallels.c

block: do not abuse EMEDIUMTYPE

2014-02-21 21:02:24 +01:00

qapi.c

Use error_is_set() only when necessary

2014-02-17 11:57:23 -05:00

qcow2-cache.c

…

qcow2-cluster.c

qcow2: Check bs->drv in copy_sectors()

2014-03-13 14:23:27 +01:00

qcow2-refcount.c

qcow2: Fix fail path in realloc_refcount_block()

2014-03-19 09:39:41 +01:00

qcow2-snapshot.c

block: Don't throw away errno via error_setg

2014-02-14 18:05:38 +01:00

qcow2.c

qcow2: fix two memory leaks in qcow2_open error code path

2014-04-01 13:49:53 +02:00

qcow2.h

…

qcow.c

Fixed various typos

2014-03-25 14:09:50 +01:00

qed-check.c

…

qed-cluster.c

…

qed-gencb.c

…

qed-l2-cache.c

…

qed-table.c

…

qed.c

block: Add error handling to bdrv_invalidate_cache()

2014-03-19 09:39:41 +01:00

qed.h

…

quorum.c

block: Add error handling to bdrv_invalidate_cache()

2014-03-19 09:39:41 +01:00

raw_bsd.c

Use error_is_set() only when necessary

2014-02-17 11:57:23 -05:00

raw-aio.h

…

raw-posix.c

block/raw-posix: Strip protocol prefix on creation

2014-03-13 14:42:25 +01:00

raw-win32.c

block/raw-win32: bdrv_parse_filename() for hdev

2014-03-13 14:42:25 +01:00

rbd.c

Use error_is_set() only when necessary

2014-02-17 11:57:23 -05:00

sheepdog.c

Fixed various typos

2014-03-25 14:09:50 +01:00

snapshot.c

Use error_is_set() only when necessary

2014-02-17 11:57:23 -05:00

ssh.c

…

stream.c

…

vdi.c

vdi: add bounds checks for blocks_in_image and disk_size header fields (CVE-2014-0144)

2014-04-01 14:06:31 +02:00

vhdx-endian.c

…

vhdx-log.c

Fixed various typos

2014-03-25 14:09:50 +01:00

vhdx.c

vhdx: Bounds checking for block_size and logical_sector_size (CVE-2014-0148)

2014-04-01 14:19:09 +02:00

vhdx.h

block: Explicitly specify 'unsigned long long' for VHDX 64-bit constants

2014-03-14 16:25:24 +01:00

vmdk.c

block/vmdk: do not report file offset for compressed extents

2014-02-28 18:59:07 +01:00

vpc.c

vpc: Validate block size (CVE-2014-0142)

2014-04-01 13:59:47 +02:00

vvfat.c

vvfat: Fix :floppy: option to suppress partition table

2014-04-01 13:49:53 +02:00

win32-aio.c

…