qcow2: Fixes for corrupted images
Status from this message: Applied to my block tree:
Get series with b4
b4 am [email protected]Versions newest first
Patches in v1 Applied
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/5 | qcow2: check_errors are fatalblock/ tests/ tests/ | +47 | 1 reply | |
| 2/5 | qcow2: Unaligned zero cluster in handle_alloc()block/ tests/ tests/ | +38 | 2 replies | |
| 3/5 | block: Guard against NULL bs->drvblock.c block/ block/ +4 more | +130 | 2 replies | |
| 4/5 | qcow2: Add bounds check to get_refblock_offset()block/ block/ tests/ +1 more | +93 | 5 replies | |
| 5/5 | qcow2: Refuse to get unaligned offsets from cacheblock/ tests/ tests/ | +71 | 7 replies |
Reviews trailers per patch
All 5 patches have a Reviewed-by or Acked-by.
| Patch | Eric Blake | Alberto Garcia |
|---|---|---|
| 1/5 | R-b | |
| 2/5 | R-b | R-b |
| 3/5 | R-b | |
| 4/5 | R-b | R-b |
| 5/5 | R-b | R-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [Qemu-devel] [PATCH for-2.11 0/5] qcow2: Fixes for corrupted images
This series contains fixes for another batch of qcow2-related crashes reported on Launchpad by Nageswara (the first batch was
http://lists.nongnu.org/archive/html/qemu-block/2017-11/msg00082.html by Berto).
Patch 4 fixes an out-of-bounds array access in memory which is not really a security issue for multiple reasons (really, at most you can read eight bytes from somewhere with an extremely high chance of crashing qemu and requiring the user to invoke a block_resize shrinking the qcow2 image (and also reset some bit in the image from 1 to 0, but only if the overlap checks don't catch you)), but most importantly that code hasn't been in 2.10, so we're fine.
Max Reitz (5):
qcow2: check_errors are fatal
qcow2: Unaligned zero cluster in handle_alloc()
block: Guard against NULL bs->drv
qcow2: Add bounds check to get_refblock_offset()
qcow2: Refuse to get unaligned offsets from cache
block/qcow2.h | 6 --- block.c | 19 ++++++- block/io.c | 36 +++++++++++++ block/qapi.c | 8 ++- block/qcow2-cache.c | 21 ++++++++ block/qcow2-cluster.c | 13 ++++- block/qcow2-refcount.c | 26 +++++++++- block/qcow2.c | 5 +- block/replication.c | 15 ++++++ block/vvfat.c | 2 +- tests/qemu-iotests/060 | 125 +++++++++++++++++++++++++++++++++++++++++++++ tests/qemu-iotests/060.out | 115 +++++++++++++++++++++++++++++++++++++++++ 12 files changed, 379 insertions(+), 12 deletions(-)
Signature · 1 line
2.13.6