aboutsummaryrefslogtreecommitdiff
path: root/block/parallels.c
diff options
context:
space:
mode:
authorKevin Wolf <kwolf@redhat.com>2014-03-26 13:06:09 +0100
committerStefan Hajnoczi <stefanha@redhat.com>2014-04-01 15:22:35 +0200
commit9302e863aa8baa5d932fc078967050c055fa1a7f (patch)
tree1438bb12aa1447fbd965e1b4f09e55384c014743 /block/parallels.c
parentafbcc40bee4ef51731102d7d4b499ee12fc182e1 (diff)
downloadqemu-9302e863aa8baa5d932fc078967050c055fa1a7f.zip
qemu-9302e863aa8baa5d932fc078967050c055fa1a7f.tar.gz
qemu-9302e863aa8baa5d932fc078967050c055fa1a7f.tar.bz2
parallels: Sanity check for s->tracks (CVE-2014-0142)
This avoids a possible division by zero. Convert s->tracks to unsigned as well because it feels better than surviving just because the results of calculations with s->tracks are converted to unsigned anyway. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'block/parallels.c')
-rw-r--r--block/parallels.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/block/parallels.c b/block/parallels.c
index fe47ecb..1a5bd35 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -51,7 +51,7 @@ typedef struct BDRVParallelsState {
uint32_t *catalog_bitmap;
unsigned int catalog_size;
- int tracks;
+ unsigned int tracks;
} BDRVParallelsState;
static int parallels_probe(const uint8_t *buf, int buf_size, const char *filename)
@@ -93,6 +93,11 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags,
bs->total_sectors = le32_to_cpu(ph.nb_sectors);
s->tracks = le32_to_cpu(ph.tracks);
+ if (s->tracks == 0) {
+ error_setg(errp, "Invalid image: Zero sectors per track");
+ ret = -EINVAL;
+ goto fail;
+ }
s->catalog_size = le32_to_cpu(ph.catalog_entries);
if (s->catalog_size > INT_MAX / 4) {