From 9af4ce8dc021c44a5f0a7247c9ea17ecf1164cf6 Mon Sep 17 00:00:00 2001 From: Kevin Wolf Date: Thu, 5 Mar 2015 10:38:10 +0000 Subject: [PATCH] qcow2: Fix L1 allocation size in qcow2_snapshot_load_tmp() (CVE-2014-0145) For the L1 table to loaded for an internal snapshot, the code allocated only enough memory to hold the currently active L1 table. If the snapshot's L1 table is actually larger than the current one, this leads to a buffer overflow. Signed-off-by: Kevin Wolf Reviewed-by: Max Reitz Signed-off-by: Stefan Hajnoczi Signed-off-by: Stefano Stabellini --- block/qcow2-snapshot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c index 4e7c93b8b..0c446bc54 100644 --- a/block/qcow2-snapshot.c +++ b/block/qcow2-snapshot.c @@ -636,7 +636,7 @@ int qcow2_snapshot_load_tmp(BlockDriverState *bs, const char *snapshot_name) sn = &s->snapshots[snapshot_index]; /* Allocate and read in the snapshot's L1 table */ - new_l1_bytes = s->l1_size * sizeof(uint64_t); + new_l1_bytes = sn->l1_size * sizeof(uint64_t); new_l1_table = g_malloc0(align_offset(new_l1_bytes, 512)); ret = bdrv_pread(bs->file, sn->l1_table_offset, new_l1_table, new_l1_bytes); -- 2.39.5