Re: [Qemu-devel] [PATCH for-2.0 17/47] vhdx: Bounds checking for block_size and logical_sector_size (CVE-2014-0148)

[Max Reitz]

On 26.03.2014 13:05, Stefan Hajnoczi wrote:
> From: Jeff Cody <address@hidden>
>
> Other variables (e.g. sectors_per_block) are calculated using these
> variables, and if not range-checked illegal values could be obtained
> causing infinite loops and other potential issues when calculating
> BAT entries.
>
> The 1.00 VHDX spec requires BlockSize to be min 1MB, max 256MB.
> LogicalSectorSize is required to be either 512 or 4096 bytes.
>
> Reported-by: Kevin Wolf <address@hidden>
> Signed-off-by: Jeff Cody <address@hidden>
> Signed-off-by: Kevin Wolf <address@hidden>
> ---
>   block/vhdx.c | 12 ++++++++++--
>   1 file changed, 10 insertions(+), 2 deletions(-)

Reviewed-by: Max Reitz <address@hidden>