[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] fix heap overflow in block-vmdk.c
From: |
Eric Milliken |
Subject: |
[Qemu-devel] [PATCH] fix heap overflow in block-vmdk.c |
Date: |
Sun, 13 Jan 2008 14:38:54 -0500 |
It's possible to set a parentFileNameHint argument > 1023 bytes in the
image file, causing an overflow at the strncpy.
diff -ru qemu-0.9.1/block-vmdk.c qemu-0.9.1-p/block-vmdk.c
--- qemu-0.9.1/block-vmdk.c 2008-01-06 14:38:42.000000000 -0500
+++ qemu-0.9.1-p/block-vmdk.c 2008-01-13 14:30:23.000000000 -0500
@@ -342,6 +342,9 @@
if ((end_name = strchr(p_name,'\"')) == 0)
return -1;
+ if ((end_name - p_name) > sizeof (s->hd->backing_file) - 1)
+ return -1;
+
strncpy(s->hd->backing_file, p_name, end_name - p_name);
if (stat(s->hd->backing_file, &file_buf) != 0) {
path_combine(parent_img_name, sizeof(parent_img_name),
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Qemu-devel] [PATCH] fix heap overflow in block-vmdk.c,
Eric Milliken <=