Re: [Qemu-devel] [PATCH for-2.0 20/47] qcow2: Check backing_file_offset (CVE-2014-0144)

[Max Reitz]

On 26.03.2014 13:05, Stefan Hajnoczi wrote:
> From: Kevin Wolf <address@hidden>
>
> Header, header extension and the backing file name must all be stored in
> the first cluster. Setting the backing file to a much higher value
> allowed header extensions to become much bigger than we want them to be
> (unbounded allocation).
>
> Signed-off-by: Kevin Wolf <address@hidden>
> ---
>   block/qcow2.c              |  6 ++++++
>   tests/qemu-iotests/080     | 12 ++++++++++++
>   tests/qemu-iotests/080.out |  7 +++++++
>   3 files changed, 25 insertions(+)

Reviewed-by: Max Reitz <address@hidden>