diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2014-03-26 13:06:05 +0100 |
|---|---|---|
| committer | Stefan Hajnoczi <stefanha@redhat.com> | 2014-04-01 15:22:35 +0200 |
| commit | c05e4667be91b46ab42b5a11babf8e84d476cc6b (patch) | |
| tree | a8cf1a43cc5b3fc6858a11bdb9bfe85c5ed26857 /tests/qemu-iotests/029.out | |
| parent | 11b128f4062dd7f89b14abc8877ff20d41b28be9 (diff) | |
| download | qemu-c05e4667be91b46ab42b5a11babf8e84d476cc6b.tar.gz qemu-c05e4667be91b46ab42b5a11babf8e84d476cc6b.tar.bz2 qemu-c05e4667be91b46ab42b5a11babf8e84d476cc6b.zip | |
qcow2: Fix L1 allocation size in qcow2_snapshot_load_tmp() (CVE-2014-0145)
For the L1 table to loaded for an internal snapshot, the code allocated
only enough memory to hold the currently active L1 table. If the
snapshot's L1 table is actually larger than the current one, this leads
to a buffer overflow.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'tests/qemu-iotests/029.out')
| -rw-r--r-- | tests/qemu-iotests/029.out | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/tests/qemu-iotests/029.out b/tests/qemu-iotests/029.out index 9029698a1c..ce0e64d24a 100644 --- a/tests/qemu-iotests/029.out +++ b/tests/qemu-iotests/029.out @@ -20,4 +20,8 @@ wrote 4096/4096 bytes at offset 1099511627776 read 4096/4096 bytes at offset 1099511627776 4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) No errors were found on the image. + +qcow2_snapshot_load_tmp() should take the L1 size from the snapshot + +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 *** done |