Google Git
Sign in
qemu / qemu / a5fff8d4b4d928311a5005efa12d0991fe3b66f9
commita5fff8d4b4d928311a5005efa12d0991fe3b66f9[log] [tgz]
authorVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>Wed Feb 27 16:14:30 2019 +0300
committerMax Reitz <mreitz@redhat.com>Tue May 07 17:14:21 2019 +0200
tree23e9fcc05dc61c55bed7705ae09430959c692cd0
parent7e3e736cbd37a633ed5673de4254424745fbf520 [diff]
qcow2-refcount: avoid eating RAM

qcow2_inc_refcounts_imrt() (through realloc_refcount_array()) can eat
an unpredictable amount of memory on corrupted table entries, which are
referencing regions far beyond the end of file.

Prevent this, by skipping such regions from further processing.

Interesting that iotest 138 checks exactly the behavior which we fix
here. So, change the test appropriately.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 20190227131433.197063-3-vsementsov@virtuozzo.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
3 files changed
tree: 23e9fcc05dc61c55bed7705ae09430959c692cd0
  1. accel/
  2. audio/
  3. authz/
  4. backends/
  5. block/
  6. bsd-user/
  7. chardev/
  8. contrib/
  9. crypto/
  10. default-configs/
  11. disas/
  12. docs/
  13. fpu/
  14. fsdev/
  15. gdb-xml/
  16. hw/
  17. include/
  18. io/
  19. libdecnumber/
  20. linux-headers/
  21. linux-user/
  22. migration/
  23. nbd/
  24. net/
  25. pc-bios/
  26. po/
  27. python/
  28. qapi/
  29. qga/
  30. qobject/
  31. qom/
  32. replay/
  33. roms/
  34. scripts/
  35. scsi/
  36. stubs/
  37. target/
  38. tcg/
  39. tests/
  40. trace/
  41. ui/
  42. util/
  43. capstone
  44. dtc
  45. slirp
  46. .cirrus.yml
  47. .dir-locals.el
  48. .editorconfig
  49. .exrc
  50. .gdbinit
  51. .gitignore
  52. .gitlab-ci.yml
  53. .gitmodules
  54. .gitpublish
  55. .mailmap
  56. .shippable.yml
  57. .travis.yml
  58. arch_init.c
  59. balloon.c
  60. block.c
  61. blockdev-nbd.c
  62. blockdev.c
  63. blockjob.c
  64. bootdevice.c
  65. bt-host.c
  66. bt-vhci.c
  67. Changelog
  68. CODING_STYLE
  69. configure
  70. COPYING
  71. COPYING.LIB
  72. cpus-common.c
  73. cpus.c
  74. device-hotplug.c
  75. device_tree.c
  76. disas.c
  77. dma-helpers.c
  78. dump.c
  79. exec.c
  80. gdbstub.c
  81. gitdm.config
  82. HACKING
  83. hmp-commands-info.hx
  84. hmp-commands.hx
  85. hmp.c
  86. hmp.h
  87. ioport.c
  88. iothread.c
  89. job-qmp.c
  90. job.c
  91. Kconfig.host
  92. LICENSE
  93. MAINTAINERS
  94. Makefile
  95. Makefile.objs
  96. Makefile.target
  97. memory.c
  98. memory_ldst.inc.c
  99. memory_mapping.c
  100. module-common.c
  101. monitor.c
  102. numa.c
  103. os-posix.c
  104. os-win32.c
  105. qdev-monitor.c
  106. qemu-bridge-helper.c
  107. qemu-deprecated.texi
  108. qemu-doc.texi
  109. qemu-edid.c
  110. qemu-ga.texi
  111. qemu-img-cmds.hx
  112. qemu-img.c
  113. qemu-img.texi
  114. qemu-io-cmds.c
  115. qemu-io.c
  116. qemu-keymap.c
  117. qemu-nbd.c
  118. qemu-nbd.texi
  119. qemu-option-trace.texi
  120. qemu-options-wrapper.h
  121. qemu-options.h
  122. qemu-options.hx
  123. qemu-seccomp.c
  124. qemu-tech.texi
  125. qemu.nsi
  126. qemu.sasl
  127. qmp.c
  128. qtest.c
  129. README
  130. replication.c
  131. replication.h
  132. rules.mak
  133. thunk.c
  134. tpm.c
  135. trace-events
  136. VERSION
  137. version.rc
  138. vl.c
  139. win_dump.c
  140. win_dump.h