Kevin Wolf 63a3acd24a qcow2: Fix header extension size check ...

After reading the extension header, offset is incremented, but not
checked against end_offset any more. This way an integer overflow could
happen when checking whether the extension end is within the allowed
range, effectively disabling the check.

This patch adds the missing check and a test case for it.

Cc: qemu-stable@nongnu.org
Reported-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1416935562-7760-2-git-send-email-kwolf@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 2ebafc854d)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

2015-02-22 12:10:11 -06:00

..

accounting.c

block: Make the block accounting functions operate on BlockAcctStats

2014-09-10 10:41:29 +02:00

archipelago.c

block: Rename BlockDriverCompletionFunc to BlockCompletionFunc

2014-10-20 13:41:27 +02:00

backup.c

block: let backup blockjob run in BDS AioContext

2014-11-03 11:41:49 +00:00

blkdebug.c

qcow2: Optimize bdrv_make_empty()

2014-11-03 11:41:48 +00:00

blkverify.c

block: Rename BlockDriverCompletionFunc to BlockCompletionFunc

2014-10-20 13:41:27 +02:00

block-backend.c

block: Make device model's references to BlockBackend strong

2014-10-20 14:03:51 +02:00

bochs.c

block: Use g_new() & friends to avoid multiplying sizes

2014-08-20 11:51:28 +02:00

cloop.c

cloop: Handle failure for potentially large allocations

2014-08-15 15:07:15 +02:00

commit.c

block: let commit blockjob run in BDS AioContext

2014-11-03 11:41:49 +00:00

curl.c

block/curl: Improve type safety of s->timeout.

2014-11-03 11:41:47 +00:00

dmg.c

dmg: Handle failure for potentially large allocations

2014-08-15 15:07:15 +02:00

gluster.c

block: don't convert file size to sector size

2014-09-12 15:43:06 +02:00

iscsi.c

Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

2014-11-03 18:34:09 +00:00

linux-aio.c

block: Rename BlockDriverCompletionFunc to BlockCompletionFunc

2014-10-20 13:41:27 +02:00

Makefile.objs

qemu-img: Implement commit like QMP

2014-11-03 11:41:48 +00:00

mirror.c

block: let mirror blockjob run in BDS AioContext

2014-11-03 11:41:49 +00:00

nbd-client.c

nbd: implement .bdrv_detach/attach_aio_context()

2014-06-04 09:56:11 +02:00

nbd-client.h

nbd: implement .bdrv_detach/attach_aio_context()

2014-06-04 09:56:11 +02:00

nbd.c

nbd: Fix filename generation

2014-10-20 13:41:26 +02:00

nfs.c

block/nfs: Add create_opts

2015-02-22 12:03:37 -06:00

null.c

block: Rename BlockDriverCompletionFunc to BlockCompletionFunc

2014-10-20 13:41:27 +02:00

parallels.c

block/parallels: fix access to not initialized memory in catalog_bitmap

2014-11-03 09:48:41 +00:00

qapi.c

Revert "qemu-img info: show nocow info"

2014-11-24 13:52:10 +01:00

qcow2-cache.c

qcow2: Use g_try_new0() for cache array

2014-08-20 11:51:28 +02:00

qcow2-cluster.c

qcow2: Prevent numerical overflow

2015-02-22 12:09:44 -06:00

qcow2-refcount.c

block/qcow2: Make get_refcount() global

2014-11-03 11:41:49 +00:00

qcow2-snapshot.c

qcow2: Allow "full" discard

2014-11-03 11:41:47 +00:00

qcow2.c

qcow2: Fix header extension size check

2015-02-22 12:10:11 -06:00

qcow2.h

block/qcow2: Make get_refcount() global

2014-11-03 11:41:49 +00:00

qcow.c

block: Eliminate BlockDriverState member device_name[]

2014-10-20 13:41:26 +02:00

qed-check.c

block: Use g_new() & friends to avoid multiplying sizes

2014-08-20 11:51:28 +02:00

qed-cluster.c

…

qed-gencb.c

block: Rename BlockDriverCompletionFunc to BlockCompletionFunc

2014-10-20 13:41:27 +02:00

qed-l2-cache.c

…

qed-table.c

block: Rename BlockDriverCompletionFunc to BlockCompletionFunc

2014-10-20 13:41:27 +02:00

qed.c

block: Rename BlockDriverCompletionFunc to BlockCompletionFunc

2014-10-20 13:41:27 +02:00

qed.h

block: Rename BlockDriverCompletionFunc to BlockCompletionFunc

2014-10-20 13:41:27 +02:00

quorum.c

block: Rename BlockDriverCompletionFunc to BlockCompletionFunc

2014-10-20 13:41:27 +02:00

raw_bsd.c

block: Make essential BlockDriver objects public

2015-02-22 12:03:18 -06:00

raw-aio.h

block: Rename BlockDriverCompletionFunc to BlockCompletionFunc

2014-10-20 13:41:27 +02:00

raw-posix.c

block/raw-posix: Fix ret in raw_open_common()

2015-02-22 12:10:01 -06:00

raw-win32.c

block: Make essential BlockDriver objects public

2015-02-22 12:03:18 -06:00

rbd.c

rbd: Add support for bdrv_invalidate_cache

2014-11-03 09:48:41 +00:00

sheepdog.c

block: Rename BlockDriverAIOCB* to BlockAIOCB*

2014-10-20 13:41:27 +02:00

snapshot.c

snapshot: add bdrv_drain_all() to bdrv_snapshot_delete() to avoid concurrency problem

2014-11-03 09:48:42 +00:00

ssh.c

ssh: Don't crash if either host or path is not specified.

2014-10-03 10:30:33 +01:00

stream.c

block: let stream blockjob run in BDS AioContext

2014-11-03 11:41:49 +00:00

vdi.c

block/vdi: Limit maximum size even futher

2014-11-09 23:39:50 +01:00

vhdx-endian.c

block: VHDX endian fixes

2014-08-15 15:07:14 +02:00

vhdx-log.c

block: Drop some superfluous casts from void *

2014-08-20 11:51:28 +02:00

vhdx.c

block: Eliminate BlockDriverState member device_name[]

2014-10-20 13:41:26 +02:00

vhdx.h

block: VHDX endian fixes

2014-08-15 15:07:14 +02:00

vmdk.c

vmdk: Leave bdi intact if -ENOTSUP in vmdk_get_info

2014-11-14 09:20:45 +00:00

vpc.c

block: Eliminate BlockDriverState member device_name[]

2014-10-20 13:41:26 +02:00

vvfat.c

block/vvfat: qcow driver may not be found

2015-02-22 12:03:31 -06:00

win32-aio.c

block: Rename BlockDriverCompletionFunc to BlockCompletionFunc

2014-10-20 13:41:27 +02:00