qemu-ios

0 Fork 0

T

Stefan Hajnoczi 7dcffbb2bf block/cloop: refuse images with huge offsets arrays (CVE-2014-0144)

Limit offsets_size to 512 MB so that:

1. g_malloc() does not abort due to an unreasonable size argument.

2. offsets_size does not overflow the bdrv_pread() int size argument.

This limit imposes a maximum image size of 16 TB at 256 KB block size.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 7b103b36d6)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

2014-07-03 16:18:10 -05:00

audio

ossaudio: check for oss support in oss_audio_init

2013-11-07 12:26:00 +01:00

backends

rng-egd: offset the point when repeatedly read from the buffer

2013-11-21 17:39:17 +01:00

block

block/cloop: refuse images with huge offsets arrays (CVE-2014-0144)

2014-07-03 16:18:10 -05:00

bsd-user

*-user: Improve documentation for lock_user function

2013-09-20 20:09:24 +04:00

default-configs

arm11mpcore: Split off SCU device

2013-11-05 17:47:30 +01:00

disas

disas/ppc.c: Fix little endian disassembly

2013-09-02 10:06:41 +02:00

docs

savevm: Ignore minimum_version_id_old if there is no load_state_old

2014-06-26 14:26:28 -05:00

dtc @ bc895d6d09

…

fpu

…

fsdev

…

gdb-xml

target-arm: Add AArch64 gdbstub support

2013-09-10 19:11:28 +01:00

virtio: allow mapping up to max queue size

2014-07-01 11:03:24 -05:00

include

vmstate: s/VMSTATE_INT32_LE/VMSTATE_INT32_POSITIVE_LE/

2014-06-26 14:21:46 -05:00

libcacard

Merge remote-tracking branch 'stefanha/block' into staging

2013-09-23 11:53:05 -05:00

linux-headers

linux-headers: update to 3.12-rc1

2013-09-20 12:38:48 +02:00

linux-user

linux-user/elfload.c: Fix A64 code which was incorrectly acting like A32

2014-06-26 15:43:30 -05:00

net

tap: avoid deadlocking rx

2014-06-25 15:17:15 -05:00

pc-bios

Update OpenBIOS images

2014-02-21 00:34:41 -06:00

pixman @ 97336fad32

…

po/Makefile: fix $SRC_PATH reference

2014-06-25 17:09:33 -05:00

qapi

qapi: fix memleak by adding implict struct functions in dealloc visitor

2013-11-05 19:58:38 -08:00

qga

qga: Fix memory allocation pasto

2014-02-25 13:34:15 -06:00

qobject

qdict: Extract qdict_extract_subqdict

2013-09-25 16:21:28 +02:00

qom

qom: Avoid leaking str and bool properties on failure

2014-06-25 15:11:17 -05:00

roms

Update OpenBIOS images

2014-02-21 00:34:41 -06:00

scripts

Adjust qapi-visit for python-2.4.3

2013-11-11 10:02:21 -05:00

slirp

misc: Spelling and grammar fixes in comments

2013-10-26 13:06:45 +04:00

stubs

Merge remote-tracking branch 'kiszka/queues/slirp' into staging

2013-09-17 10:01:24 -05:00

sysconfigs/target

…

target-alpha

misc: New spelling fixes in comments

2013-10-26 13:01:57 +04:00

target-arm

target-arm: Make vbar_write 64bit friendly on 32bit hosts

2014-06-26 15:39:34 -05:00

target-cris

tcg: Remove stray semi-colons from target-*/helper.h

2013-10-10 11:43:37 -07:00

target-i386

target-i386: fix set of registers zeroed on reset

2014-06-26 14:57:46 -05:00

target-lm32

target: Include softmmu_exec.h where forgotten

2013-09-02 09:08:30 -07:00

target-m68k

Merge remote-tracking branch 'rth/tcg-pull' into staging

2013-10-11 09:36:52 -07:00

target-microblaze

microblaze: At swx, check that the reserved word is unmodified

2013-10-24 22:32:56 +02:00

target-mips

target-mips: fix 64-bit FPU config for user-mode emulation

2014-02-20 21:59:18 -06:00

target-moxie

cpu: Drop cpu_model_str from CPU_COMMON

2013-10-07 11:48:47 +02:00

target-openrisc

target-openrisc: Correct memory bounds checking for the tlb buffers

2013-11-20 21:47:17 +08:00

target-ppc

spapr: Use DeviceClass::fw_name for device tree CPU node

2013-10-25 23:25:48 +02:00

target-s390x

s390x: empty function stubs in preparation for __KVM_HAVE_GUEST_DEBUG

2014-06-25 16:43:05 -05:00

target-sh4

Merge remote-tracking branch 'rth/tcg-pull' into staging

2013-10-11 09:36:52 -07:00

target-sparc

Merge remote-tracking branch 'rth/tcg-pull' into staging

2013-10-11 09:36:52 -07:00

target-unicore32

Merge remote-tracking branch 'rth/tcg-pull' into staging

2013-10-11 09:36:52 -07:00

target-xtensa

target-xtensa: add missing DEBUG section to dc233c config

2013-11-08 09:26:07 +04:00

tcg

tcg-arm: The shift count of op_rotl_i32 is in args[2] not args[1].

2014-02-21 00:40:04 -06:00

tests

block/cloop: refuse images with huge offsets arrays (CVE-2014-0144)

2014-07-03 16:18:10 -05:00

trace

…

curses: fixup SIGWINCH handler mess

2013-11-25 20:36:27 -08:00

util

qmp: access the local QemuOptsLists for drive option

2013-11-14 13:09:07 +01:00

.exrc

…

.gitignore

.gitignore: ignore qmp-commands.txt

2013-10-26 13:01:57 +04:00

.gitmodules

Use qemu-project.org domain name

2013-10-11 09:34:56 -07:00

.mailmap

Update mailmap

2013-09-05 09:40:31 -05:00

.travis.yml

.travis.yml: basic compile and check recipes

2013-11-13 15:48:38 +04:00

aio-posix.c

aio / timers: Convert aio_poll to use AioContext timers' deadline

2013-08-22 19:10:28 +02:00

aio-win32.c

aio-win32: replace incorrect AioHandler->opaque usage with ->e

2013-08-22 22:04:54 +02:00

arch_init.c

migration: catch unknown flags in ram_load

2014-07-01 11:11:36 -05:00

async.c

aio / timers: aio_ctx_prepare sets timeout from AioContext timers

2013-08-22 19:10:28 +02:00

balloon.c

…

block-migration.c

migration: omit drive ref as we have bdrv_ref now

2013-09-06 15:25:08 +02:00

block.c

block: Use BDRV_O_NO_BACKING where appropriate

2014-06-25 16:33:46 -05:00

blockdev-nbd.c

nbd: use BlockDriverState refcnt

2013-09-06 15:25:08 +02:00

blockdev.c

block-commit: speed is an optional parameter

2014-06-25 15:39:13 -05:00

blockjob.c

qapi: make use of new BlockJobType

2013-10-11 10:52:54 +02:00

bt-host.c

…

bt-vhci.c

…

Changelog

Use qemu-project.org domain name

2013-10-11 09:34:56 -07:00

CODING_STYLE

…

configure

configure: Don't use __int128_t for clang versions before 3.2

2014-06-25 15:24:19 -05:00

COPYING

…

COPYING.LIB

…

coroutine-gthread.c

…

coroutine-sigaltstack.c

…

coroutine-ucontext.c

…

coroutine-win32.c

…

cpu-exec.c

cpu-exec: Also reload CPUClass *cc after longjmp return in cpu_exec()

2013-10-07 11:46:58 +02:00

cpus.c

timers: fix stop/cont with -icount

2013-11-06 21:47:05 -08:00

cputlb.c

cputlb: Remove dead function tlb_update_dirty()

2013-10-07 11:48:03 +02:00

device_tree.c

…

device-hotplug.c

…

disas.c

disas: Implement fallback to dump object code as hex

2013-08-24 07:26:45 +02:00

dma-helpers.c

aio / timers: Untangle include files

2013-08-22 19:10:27 +02:00

dump.c

dump-guest-memory: Check for the correct return value

2013-10-25 23:25:48 +02:00

exec.c

memory: fix limiting of translation at a page boundary

2014-02-21 00:36:00 -06:00

gdbstub.c

vl: allow "cont" from panicked state

2013-11-04 15:39:41 +02:00

HACKING

…

hmp-commands.hx

hmp: add interface hmp_snapshot_delete_blkdev_internal

2013-09-12 10:12:47 +02:00

hmp.c

hmp: drop bogus "[not inserted]"

2013-10-17 10:10:14 +02:00

hmp.h

hmp: add interface hmp_snapshot_delete_blkdev_internal

2013-09-12 10:12:47 +02:00

iohandler.c

…

ioport.c

portio: Allow to mark portio lists as coalesced MMIO flushing

2013-10-17 17:24:15 +02:00

kvm-all.c

KVM: Use return value for error print

2014-02-27 10:54:41 -06:00

kvm-stub.c

kvm irqfd: support direct msimessage to irq translation

2013-09-20 12:37:52 +02:00

LICENSE

…

main-loop.c

slirp: set mainloop timeout with more precise value

2013-09-17 12:26:05 +02:00

MAINTAINERS

MAINTAINERS: add block driver sub-maintainers

2013-11-15 13:37:48 +01:00

Makefile

sun4m: Add FCode ROM for TCX framebuffer

2013-11-21 17:38:52 +01:00

Makefile.objs

qemu-ga: Add Windows VSS provider and requester as DLL

2013-09-09 14:17:57 -05:00

Makefile.target

default-configs/: CONFIG_GDBSTUB_XML removed

2013-10-16 18:21:01 +02:00

memory_mapping.c

cpu: Use QTAILQ for CPU list

2013-09-03 12:25:55 +02:00

memory.c

memory.c: bugfix - ref counting mismatch in memory_region_find

2014-02-20 21:59:18 -06:00

migration-exec.c

aio / timers: Untangle include files

2013-08-22 19:10:27 +02:00

migration-fd.c

aio / timers: Untangle include files

2013-08-22 19:10:27 +02:00

migration-rdma.c

rdma: constify ram_chunk_{index, start, end}

2013-09-24 13:22:50 +02:00

migration-tcp.c

aio / timers: Untangle include files

2013-08-22 19:10:27 +02:00

migration-unix.c

aio / timers: Untangle include files

2013-08-22 19:10:27 +02:00

migration.c

migration: catch unknown flags in ram_load

2014-07-01 11:11:36 -05:00

monitor.c

Merge remote-tracking branch 'agraf/ppc-for-upstream' into staging

2013-10-31 17:01:12 +01:00

nbd.c

nbd: use BlockDriverState refcnt

2013-09-06 15:25:08 +02:00

os-posix.c

…

os-win32.c

…

page_cache.c

…

qapi-schema.json

qapi-schema: Update description for NewImageMode

2013-11-14 13:09:06 +01:00

qdev-monitor.c

qdev-monitor: Avoid device_add crashing on non-device driver name

2014-02-20 21:59:18 -06:00

qdict-test-data.txt

…

qemu-bridge-helper.c

…

qemu-char.c

char: restore read callback on a reattached (hotplug) chardev

2014-06-20 08:19:49 -05:00

qemu-coroutine-io.c

aio / timers: Untangle include files

2013-08-22 19:10:27 +02:00

qemu-coroutine-lock.c

…

qemu-coroutine-sleep.c

coroutine: add co_aio_sleep_ns() to allow sleep in block drivers

2013-10-30 12:22:09 +01:00

qemu-coroutine.c

coroutine: add ./configure --disable-coroutine-pool

2013-09-12 10:12:48 +02:00

qemu-doc.texi

…

qemu-img-cmds.hx

block: Image file option amendment

2013-09-12 10:12:46 +02:00

qemu-img.c

qemu-img: Fix overwriting 'ret' before using

2013-11-15 13:37:48 +01:00

qemu-img.texi

block: Image file option amendment

2013-09-12 10:12:46 +02:00

qemu-io-cmds.c

block/qapi: Human-readable ImageInfoSpecific dump

2013-10-11 10:52:54 +02:00

qemu-io.c

qemu-io: Let "open" pass options to block driver

2013-10-11 16:50:02 +02:00

qemu-log.c

…

qemu-nbd.c

block: Error parameter for open functions

2013-09-12 10:12:48 +02:00

qemu-nbd.texi

…

qemu-options-wrapper.h

…

qemu-options.h

…

qemu-options.hx

doc: fix hardcoded helper path

2013-11-18 13:45:10 +02:00

qemu-seccomp.c

seccomp: exit if seccomp_init() fails

2014-02-21 00:34:40 -06:00

qemu-tech.texi

…

qemu-timer.c

timer: add timer_mod_anticipate and timer_mod_anticipate_ns

2013-10-17 17:31:00 +02:00

qemu.nsi

nsis: Improved support for parallel installation of 32 and 64 bit code

2013-11-07 07:02:44 +01:00

qemu.sasl

…

qmp-commands.hx

blockdev: 'blockdev-add' QMP command

2013-10-11 16:50:01 +02:00

qmp.c

…

qtest.c

qtest: Fix FMT_timeval vs time_t

2013-09-02 09:08:29 -07:00

readline.c

monitor: avoid use of global *cur_mon in readline_completion()

2013-08-30 07:41:14 -04:00

README

Use qemu-project.org domain name

2013-10-11 09:34:56 -07:00

rules.mak

rules.mak: New string testing functions

2013-10-16 18:21:00 +02:00

savevm.c

savevm: Ignore minimum_version_id_old if there is no load_state_old

2014-06-26 14:26:28 -05:00

spice-qemu-char.c

…

tcg-runtime.c

…

tci.c

misc: Use new rotate functions

2013-09-25 21:23:05 +02:00

thread-pool.c

aio / timers: Untangle include files

2013-08-22 19:10:27 +02:00

thunk.c

…

tpm.c

…

trace-events

megasas: Implement LD_LIST_QUERY

2014-06-25 16:02:25 -05:00

translate-all.c

split definitions for exec.c and translate-all.c radix trees

2014-02-20 21:59:18 -06:00

translate-all.h

split definitions for exec.c and translate-all.c radix trees

2014-02-20 21:59:18 -06:00

user-exec.c

…

VERSION

Update VERSION for 1.7.1 release

2014-03-03 16:30:51 -06:00

version.rc

Use qemu-project.org domain name

2013-10-11 09:34:56 -07:00

vl.c

qemu_opts_parse(): always check return value

2014-02-21 00:34:40 -06:00

xbzrle.c

…

xen-all.c

qemu/xen: make use of xenstore relative paths

2013-10-10 14:25:52 +00:00

xen-mapcache.c

…

xen-stub.c

pc: Initializing ram_memory under Xen.

2013-09-09 16:22:19 +00:00

README

Read the documentation in qemu-doc.html or on http://wiki.qemu-project.org

- QEMU team