projects / qemu.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 11b128f) | patch
qcow2: Fix L1 allocation size in qcow2_snapshot_load_tmp() (CVE-2014-0145)
authorKevin Wolf <kwolf@redhat.com>
Wed, 26 Mar 2014 12:06:05 +0000 (13:06 +0100)
committerStefan Hajnoczi <stefanha@redhat.com>
Tue, 1 Apr 2014 13:22:35 +0000 (15:22 +0200)
commitc05e4667be91b46ab42b5a11babf8e84d476cc6b
treea8cf1a43cc5b3fc6858a11bdb9bfe85c5ed26857tree | snapshot
parent11b128f4062dd7f89b14abc8877ff20d41b28be9commit | diff
qcow2: Fix L1 allocation size in qcow2_snapshot_load_tmp() (CVE-2014-0145)

For the L1 table to loaded for an internal snapshot, the code allocated
only enough memory to hold the currently active L1 table. If the
snapshot's L1 table is actually larger than the current one, this leads
to a buffer overflow.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
block/qcow2-snapshot.c diff | blob | history
tests/qemu-iotests/029 diff | blob | history
tests/qemu-iotests/029.out diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.