From 3d7ed9c453ad10e73edbcde1b718506ed7b86388 Mon Sep 17 00:00:00 2001 From: Kevin Wolf Date: Mon, 5 Mar 2018 18:15:26 +0100 Subject: luks: Catch integer overflow for huge sizes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When you request an image size close to UINT64_MAX, the addition of the crypto header may cause an integer overflow. Catch it instead of silently truncating the image size. Signed-off-by: Kevin Wolf Reviewed-by: Daniel P. Berrangé --- block/crypto.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'block') diff --git a/block/crypto.c b/block/crypto.c index 00fb40c..e0b8856 100644 --- a/block/crypto.c +++ b/block/crypto.c @@ -102,6 +102,11 @@ static ssize_t block_crypto_init_func(QCryptoBlock *block, { struct BlockCryptoCreateData *data = opaque; + if (data->size > INT64_MAX || headerlen > INT64_MAX - data->size) { + error_setg(errp, "The requested file size is too large"); + return -EFBIG; + } + /* User provided size should reflect amount of space made * available to the guest, so we must take account of that * which will be used by the crypto header -- cgit v1.1