Re: [Qemu-devel] [PATCH for-2.0 36/47] dmg: sanitize chunk length and sectorcount (CVE-2014-0145)

[Max Reitz]

On 26.03.2014 13:05, Stefan Hajnoczi wrote:
> Chunk length and sectorcount are used for decompression buffers as well
> as the bdrv_pread() count argument.  Ensure that they have reasonable
> values so neither memory allocation nor conversion from uint64_t to int
> will cause problems.
>
> Signed-off-by: Stefan Hajnoczi <address@hidden>
> Signed-off-by: Kevin Wolf <address@hidden>
> ---
>   block/dmg.c | 24 ++++++++++++++++++++++++
>   1 file changed, 24 insertions(+)

Reviewed-by: Max Reitz <address@hidden>