aliguori
274fb0e1ed
check SCSI read/write requests against max LBA (Rik van Riel)
...
The bdrv layer uses a signed offset. Furthermore, block-raw-posix
only seeks when that offset is positive. Passing a negative offset
to block-raw-posix can result in data being written at the current
seek cursor's position.
It may be possible to exploit this to seek to the end of the disk
and extend the virtual disk by writing data to a negative sector
offset. After a reboot, this could lead to the guest having a
larger disk than it had before.
Close the hole by sanity checking the lba against the size of the
disk.
Signed-off-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6475 c046a42c-6fe2-441c-8c8c-71466251a162
2009-01-29 19:59:04 +00:00
..
2009-01-26 15:37:35 +00:00
2009-01-26 15:37:35 +00:00
2008-12-30 19:01:19 +00:00
2008-12-03 22:48:44 +00:00
2009-01-15 22:34:14 +00:00
2009-01-16 19:04:14 +00:00
2009-01-27 19:15:31 +00:00
2009-01-15 20:11:34 +00:00
2008-11-20 22:14:40 +00:00
2008-12-01 18:59:50 +00:00
2008-12-13 09:32:43 +00:00
2008-12-13 09:32:43 +00:00
2008-12-13 09:32:43 +00:00
2008-12-13 09:32:43 +00:00
2009-01-26 21:47:27 +00:00
2008-12-11 22:42:58 +00:00
2009-01-04 22:05:52 +00:00
2009-01-16 20:07:19 +00:00
2009-01-16 19:04:14 +00:00
2009-01-04 22:05:52 +00:00
2008-11-09 00:28:40 +00:00
2009-01-04 22:05:52 +00:00
2009-01-04 22:05:52 +00:00
2009-01-04 22:05:52 +00:00
2009-01-04 22:05:52 +00:00
2008-12-13 09:32:43 +00:00
2009-01-26 15:37:35 +00:00
2008-12-02 17:47:02 +00:00
2008-12-03 22:48:44 +00:00
2009-01-18 12:16:26 +00:00
2009-01-16 19:04:14 +00:00
2008-12-22 20:33:55 +00:00
2008-12-01 18:59:50 +00:00
2009-01-16 19:04:14 +00:00
2009-01-26 15:37:35 +00:00
2008-12-23 15:08:13 +00:00
2009-01-26 15:37:35 +00:00
2009-01-26 15:37:35 +00:00
2009-01-14 14:47:56 +00:00
2009-01-14 14:47:56 +00:00
2008-12-02 17:47:02 +00:00
2009-01-07 13:46:31 +00:00
2008-11-04 20:29:29 +00:00
2009-01-13 19:39:36 +00:00
2009-01-07 13:30:41 +00:00
2008-12-06 23:19:03 +00:00
2009-01-07 13:24:40 +00:00
2009-01-16 19:04:14 +00:00
2009-01-09 00:04:35 +00:00
2009-01-24 12:09:52 +00:00
2009-01-25 10:56:51 +00:00
2008-12-11 17:30:50 +00:00
2009-01-16 21:13:58 +00:00
2009-01-26 15:37:35 +00:00
2009-01-26 15:37:35 +00:00
2009-01-16 19:04:14 +00:00
2008-12-11 00:14:28 +00:00
2008-12-30 19:01:19 +00:00
2009-01-16 21:38:58 +00:00
2009-01-16 21:38:58 +00:00
2008-11-11 16:46:33 +00:00
2009-01-16 19:04:14 +00:00
2009-01-26 20:32:18 +00:00
2009-01-26 15:37:35 +00:00
2009-01-16 19:04:14 +00:00
2008-12-21 10:46:23 +00:00
2008-10-31 17:25:56 +00:00
2009-01-16 19:04:14 +00:00
2009-01-04 22:05:52 +00:00
2009-01-26 15:37:35 +00:00
2008-12-28 18:27:10 +00:00
2008-12-30 19:01:19 +00:00
2008-12-30 19:01:19 +00:00
2009-01-26 15:37:35 +00:00
2009-01-16 19:04:14 +00:00
2008-12-22 20:33:55 +00:00
2009-01-24 18:06:21 +00:00
2008-12-13 09:32:43 +00:00
2009-01-16 19:04:14 +00:00
2009-01-13 19:39:36 +00:00
2009-01-24 18:06:21 +00:00
2009-01-24 18:06:21 +00:00
2009-01-16 19:04:14 +00:00
2009-01-24 18:06:21 +00:00
2009-01-15 22:34:14 +00:00
2009-01-16 21:13:58 +00:00
2009-01-13 19:39:36 +00:00
2008-12-05 17:56:40 +00:00
2008-12-01 18:59:50 +00:00
2009-01-16 19:04:14 +00:00
2009-01-20 04:15:47 +00:00
2009-01-26 15:37:35 +00:00
2009-01-16 19:04:14 +00:00
2009-01-18 14:08:04 +00:00
2009-01-18 14:08:04 +00:00
2009-01-04 22:05:52 +00:00
2009-01-04 22:05:52 +00:00
2009-01-16 19:04:14 +00:00
2009-01-04 22:05:52 +00:00
2009-01-16 19:04:14 +00:00
2009-01-04 22:05:52 +00:00
2009-01-16 19:04:14 +00:00
2009-01-16 19:04:14 +00:00
2009-01-04 22:05:52 +00:00
2009-01-26 15:37:35 +00:00
2009-01-16 19:04:14 +00:00
2008-12-07 23:26:09 +00:00
2009-01-24 18:06:21 +00:00
2009-01-24 18:06:21 +00:00
2009-01-08 18:52:52 +00:00
2009-01-27 19:15:31 +00:00
2009-01-27 19:15:31 +00:00
2008-12-10 15:02:07 +00:00
2008-12-13 09:32:43 +00:00
2009-01-26 15:37:35 +00:00
2008-12-03 22:48:44 +00:00
2009-01-04 22:05:52 +00:00
2009-01-04 22:05:52 +00:00
2009-01-26 15:37:35 +00:00
2008-12-13 09:32:43 +00:00
2008-12-13 09:32:43 +00:00
2008-12-04 21:34:52 +00:00
2008-12-13 09:32:43 +00:00
2008-12-13 09:32:43 +00:00
2008-12-13 09:32:43 +00:00
2009-01-16 19:04:14 +00:00
2008-12-01 18:59:50 +00:00
2008-12-01 18:59:50 +00:00
2009-01-15 22:34:14 +00:00
2009-01-26 15:37:35 +00:00
2008-12-15 23:15:56 +00:00
2009-01-16 19:04:14 +00:00
2008-12-15 22:59:45 +00:00
2008-12-15 22:59:34 +00:00
2009-01-16 19:41:04 +00:00
2008-12-16 10:44:06 +00:00
2008-12-16 10:44:06 +00:00
2009-01-16 19:04:14 +00:00
2009-01-12 17:40:23 +00:00
2009-01-26 10:22:15 +00:00
2009-01-24 18:06:21 +00:00
2009-01-15 22:34:14 +00:00
2009-01-08 16:01:23 +00:00
2009-01-26 15:37:35 +00:00
2009-01-16 19:04:14 +00:00
2009-01-26 15:57:52 +00:00
2008-12-13 09:32:43 +00:00
2008-12-13 09:32:43 +00:00
2008-12-01 18:59:50 +00:00
2008-12-01 18:59:50 +00:00
2008-12-01 18:59:50 +00:00
2009-01-16 19:04:14 +00:00
2008-12-01 18:59:50 +00:00
2008-12-01 18:59:50 +00:00
2008-12-01 18:59:50 +00:00
2008-11-03 01:08:14 +00:00
2008-12-01 18:59:50 +00:00
2009-01-16 19:04:14 +00:00
2009-01-16 19:04:14 +00:00
2009-01-24 18:18:20 +00:00
2009-01-01 13:03:36 +00:00
2008-12-01 18:59:50 +00:00
2009-01-16 19:04:14 +00:00
2009-01-26 15:37:35 +00:00
2008-12-22 20:33:55 +00:00
2008-12-02 17:47:02 +00:00
2009-01-29 19:59:04 +00:00
2008-10-17 08:08:56 +00:00
2009-01-18 14:28:10 +00:00
2008-12-13 09:32:43 +00:00
2008-12-22 20:33:55 +00:00
2008-12-22 20:33:55 +00:00
2009-01-26 15:37:35 +00:00
2008-12-07 22:46:49 +00:00
2008-12-07 19:39:58 +00:00
2008-12-07 19:39:58 +00:00
2009-01-16 19:04:14 +00:00
2008-12-13 09:32:43 +00:00
2008-12-21 16:00:20 +00:00
2008-12-02 17:47:02 +00:00
2008-12-13 09:32:43 +00:00
2009-01-16 19:04:14 +00:00
2008-12-13 09:32:43 +00:00
2009-01-13 19:39:36 +00:00
2009-01-04 22:05:52 +00:00
2009-01-04 22:05:52 +00:00
2008-12-15 20:24:25 +00:00
2009-01-16 19:04:14 +00:00
2009-01-16 19:04:14 +00:00
2009-01-16 19:04:14 +00:00
2008-12-13 09:32:43 +00:00
2009-01-13 19:39:36 +00:00
2008-12-13 09:32:43 +00:00
2009-01-16 19:04:14 +00:00
2008-12-13 09:32:43 +00:00
2009-01-16 19:04:14 +00:00
2009-01-16 19:04:14 +00:00
2009-01-26 15:37:35 +00:00
2009-01-04 22:05:52 +00:00
2009-01-16 19:04:14 +00:00
2008-10-26 13:43:07 +00:00
2009-01-16 19:04:14 +00:00
2009-01-04 22:05:52 +00:00
2009-01-16 19:04:14 +00:00
2009-01-04 22:05:52 +00:00
2009-01-04 22:05:52 +00:00
2009-01-04 22:05:52 +00:00
2009-01-04 22:05:52 +00:00
2009-01-26 15:37:35 +00:00
2009-01-04 22:05:52 +00:00
2009-01-07 16:41:47 +00:00
2009-01-04 22:05:52 +00:00
2009-01-07 17:48:51 +00:00
2009-01-26 15:37:35 +00:00
2009-01-18 14:08:04 +00:00
2009-01-26 15:37:35 +00:00
2009-01-26 15:37:35 +00:00
2009-01-16 19:04:14 +00:00
2009-01-16 19:07:10 +00:00
2009-01-26 17:07:42 +00:00
2009-01-26 15:22:57 +00:00
2008-12-04 20:33:06 +00:00
2009-01-26 15:22:57 +00:00
2008-12-11 21:20:03 +00:00
2009-01-26 15:22:57 +00:00
2009-01-15 20:05:50 +00:00
2009-01-26 15:22:57 +00:00
2009-01-13 21:09:18 +00:00
2009-01-29 17:02:13 +00:00
2008-12-05 20:05:26 +00:00
2008-12-13 09:32:43 +00:00
2009-01-26 15:37:35 +00:00
2008-12-03 22:48:44 +00:00
2009-01-04 22:05:52 +00:00