falso
/
qemu-irix
mirror of https://github.com/n64decomp/qemu-irix.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
qemu-irix/block
History
Kevin Wolf 63a3acd24a qcow2: Fix header extension size check 
After reading the extension header, offset is incremented, but not
checked against end_offset any more. This way an integer overflow could
happen when checking whether the extension end is within the allowed
range, effectively disabling the check.

This patch adds the missing check and a test case for it.

Cc: qemu-stable@nongnu.org
Reported-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1416935562-7760-2-git-send-email-kwolf@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 2ebafc854d)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
 		2015-02-22 12:10:11 -06:00
..
Makefile.objs qemu-img: Implement commit like QMP 2014-11-03 11:41:48 +00:00
accounting.c block: Make the block accounting functions operate on BlockAcctStats 2014-09-10 10:41:29 +02:00
archipelago.c block: Rename BlockDriverCompletionFunc to BlockCompletionFunc 2014-10-20 13:41:27 +02:00
backup.c block: let backup blockjob run in BDS AioContext 2014-11-03 11:41:49 +00:00
blkdebug.c qcow2: Optimize bdrv_make_empty() 2014-11-03 11:41:48 +00:00
blkverify.c block: Rename BlockDriverCompletionFunc to BlockCompletionFunc 2014-10-20 13:41:27 +02:00
block-backend.c block: Make device model's references to BlockBackend strong 2014-10-20 14:03:51 +02:00
bochs.c block: Use g_new() & friends to avoid multiplying sizes 2014-08-20 11:51:28 +02:00
cloop.c cloop: Handle failure for potentially large allocations 2014-08-15 15:07:15 +02:00
commit.c block: let commit blockjob run in BDS AioContext 2014-11-03 11:41:49 +00:00
curl.c block/curl: Improve type safety of s->timeout. 2014-11-03 11:41:47 +00:00
dmg.c dmg: Handle failure for potentially large allocations 2014-08-15 15:07:15 +02:00
gluster.c block: don't convert file size to sector size 2014-09-12 15:43:06 +02:00
iscsi.c -----BEGIN PGP SIGNATURE----- 2014-11-03 18:34:09 +00:00
linux-aio.c block: Rename BlockDriverCompletionFunc to BlockCompletionFunc 2014-10-20 13:41:27 +02:00
mirror.c block: let mirror blockjob run in BDS AioContext 2014-11-03 11:41:49 +00:00
nbd-client.c nbd: implement .bdrv_detach/attach_aio_context() 2014-06-04 09:56:11 +02:00
nbd-client.h nbd: implement .bdrv_detach/attach_aio_context() 2014-06-04 09:56:11 +02:00
nbd.c nbd: Fix filename generation 2014-10-20 13:41:26 +02:00
nfs.c block/nfs: Add create_opts 2015-02-22 12:03:37 -06:00
null.c block: Rename BlockDriverCompletionFunc to BlockCompletionFunc 2014-10-20 13:41:27 +02:00
parallels.c block/parallels: fix access to not initialized memory in catalog_bitmap 2014-11-03 09:48:41 +00:00
qapi.c Revert "qemu-img info: show nocow info" 2014-11-24 13:52:10 +01:00
qcow.c block: Eliminate BlockDriverState member device_name[] 2014-10-20 13:41:26 +02:00
qcow2-cache.c qcow2: Use g_try_new0() for cache array 2014-08-20 11:51:28 +02:00
qcow2-cluster.c qcow2: Prevent numerical overflow 2015-02-22 12:09:44 -06:00
qcow2-refcount.c block/qcow2: Make get_refcount() global 2014-11-03 11:41:49 +00:00
qcow2-snapshot.c qcow2: Allow "full" discard 2014-11-03 11:41:47 +00:00
qcow2.c qcow2: Fix header extension size check 2015-02-22 12:10:11 -06:00
qcow2.h block/qcow2: Make get_refcount() global 2014-11-03 11:41:49 +00:00
qed-check.c block: Use g_new() & friends to avoid multiplying sizes 2014-08-20 11:51:28 +02:00
qed-cluster.c
…
qed-gencb.c block: Rename BlockDriverCompletionFunc to BlockCompletionFunc 2014-10-20 13:41:27 +02:00
qed-l2-cache.c
…
qed-table.c block: Rename BlockDriverCompletionFunc to BlockCompletionFunc 2014-10-20 13:41:27 +02:00
qed.c block: Rename BlockDriverCompletionFunc to BlockCompletionFunc 2014-10-20 13:41:27 +02:00
qed.h block: Rename BlockDriverCompletionFunc to BlockCompletionFunc 2014-10-20 13:41:27 +02:00
quorum.c block: Rename BlockDriverCompletionFunc to BlockCompletionFunc 2014-10-20 13:41:27 +02:00
raw-aio.h block: Rename BlockDriverCompletionFunc to BlockCompletionFunc 2014-10-20 13:41:27 +02:00
raw-posix.c block/raw-posix: Fix ret in raw_open_common() 2015-02-22 12:10:01 -06:00
raw-win32.c block: Make essential BlockDriver objects public 2015-02-22 12:03:18 -06:00
raw_bsd.c block: Make essential BlockDriver objects public 2015-02-22 12:03:18 -06:00
rbd.c rbd: Add support for bdrv_invalidate_cache 2014-11-03 09:48:41 +00:00
sheepdog.c block: Rename BlockDriverAIOCB* to BlockAIOCB* 2014-10-20 13:41:27 +02:00
snapshot.c snapshot: add bdrv_drain_all() to bdrv_snapshot_delete() to avoid concurrency problem 2014-11-03 09:48:42 +00:00
ssh.c ssh: Don't crash if either host or path is not specified. 2014-10-03 10:30:33 +01:00
stream.c block: let stream blockjob run in BDS AioContext 2014-11-03 11:41:49 +00:00
vdi.c block/vdi: Limit maximum size even futher 2014-11-09 23:39:50 +01:00
vhdx-endian.c block: VHDX endian fixes 2014-08-15 15:07:14 +02:00
vhdx-log.c block: Drop some superfluous casts from void * 2014-08-20 11:51:28 +02:00
vhdx.c block: Eliminate BlockDriverState member device_name[] 2014-10-20 13:41:26 +02:00
vhdx.h block: VHDX endian fixes 2014-08-15 15:07:14 +02:00
vmdk.c vmdk: Leave bdi intact if -ENOTSUP in vmdk_get_info 2014-11-14 09:20:45 +00:00
vpc.c block: Eliminate BlockDriverState member device_name[] 2014-10-20 13:41:26 +02:00
vvfat.c block/vvfat: qcow driver may not be found 2015-02-22 12:03:31 -06:00
win32-aio.c block: Rename BlockDriverCompletionFunc to BlockCompletionFunc 2014-10-20 13:41:27 +02:00