From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 5 Mar 2018 17:15:26 +0000 (+0100)
Subject: luks: Catch integer overflow for huge sizes
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=3d7ed9c453ad10e73edbcde1b718506ed7b86388;p=qemu.git

luks: Catch integer overflow for huge sizes

When you request an image size close to UINT64_MAX, the addition of the
crypto header may cause an integer overflow. Catch it instead of
silently truncating the image size.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---

diff --git a/block/crypto.c b/block/crypto.c
index 00fb40c631..e0b8856f74 100644
--- a/block/crypto.c
+++ b/block/crypto.c
@@ -102,6 +102,11 @@ static ssize_t block_crypto_init_func(QCryptoBlock *block,
 {
     struct BlockCryptoCreateData *data = opaque;
 
+    if (data->size > INT64_MAX || headerlen > INT64_MAX - data->size) {
+        error_setg(errp, "The requested file size is too large");
+        return -EFBIG;
+    }
+
     /* User provided size should reflect amount of space made
      * available to the guest, so we must take account of that
      * which will be used by the crypto header