qemu/tests/qemu-iotests/078.out

QA output created by 078

== Read from a valid image ==
read 512/512 bytes at offset 0
512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

== Negative catalog size ==
qemu-io: can't open device TEST_DIR/empty.bochs: Catalog size is too large
no file open, try 'help open'

== Overflow for catalog size * sizeof(uint32_t) ==
qemu-io: can't open device TEST_DIR/empty.bochs: Catalog size is too large
no file open, try 'help open'

== Too small catalog bitmap for image size ==
qemu-io: can't open device TEST_DIR/empty.bochs: Catalog size is too small for this disk size
no file open, try 'help open'
qemu-io: can't open device TEST_DIR/empty.bochs: Catalog size is too small for this disk size
no file open, try 'help open'

== Negative extent size ==
qemu-io: can't open device TEST_DIR/empty.bochs: Extent size 2147483648 is too large
no file open, try 'help open'

== Zero extent size ==
qemu-io: can't open device TEST_DIR/empty.bochs: Extent size must be at least 512
no file open, try 'help open'
*** done
qemu-iotests: Support for bochs format Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 2014-03-26 16:05:30 +04:00			`QA output created by 078`

			`== Read from a valid image ==`
			`read 512/512 bytes at offset 0`
			`512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)`
bochs: Use unsigned variables for offsets and sizes (CVE-2014-0147) Gets us rid of integer overflows resulting in negative sizes which aren't correctly checked. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 2014-03-26 16:05:32 +04:00
			`== Negative catalog size ==`
bochs: Check catalog_size header field (CVE-2014-0143) It should neither become negative nor allow unbounded memory allocations. This fixes aborts in g_malloc() and an s->catalog_bitmap buffer overflow on big endian hosts. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 2014-03-26 16:05:33 +04:00			`qemu-io: can't open device TEST_DIR/empty.bochs: Catalog size is too large`
			`no file open, try 'help open'`

			`== Overflow for catalog size * sizeof(uint32_t) ==`
			`qemu-io: can't open device TEST_DIR/empty.bochs: Catalog size is too large`
			`no file open, try 'help open'`

			`== Too small catalog bitmap for image size ==`
			`qemu-io: can't open device TEST_DIR/empty.bochs: Catalog size is too small for this disk size`
bochs: Use unsigned variables for offsets and sizes (CVE-2014-0147) Gets us rid of integer overflows resulting in negative sizes which aren't correctly checked. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 2014-03-26 16:05:32 +04:00			`no file open, try 'help open'`
bochs: Fix catalog size check The old check was off by a factor of 512 and didn't consider cases where we don't get an exact division. This could lead to an out-of-bounds array access in seek_to_sector(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> 2014-04-09 14:10:34 +04:00			`qemu-io: can't open device TEST_DIR/empty.bochs: Catalog size is too small for this disk size`
			`no file open, try 'help open'`
bochs: Check extent_size header field (CVE-2014-0142) This fixes two possible division by zero crashes: In bochs_open() and in seek_to_sector(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 2014-03-26 16:05:34 +04:00
			`== Negative extent size ==`
bochs: Fix catalog size check The old check was off by a factor of 512 and didn't consider cases where we don't get an exact division. This could lead to an out-of-bounds array access in seek_to_sector(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> 2014-04-09 14:10:34 +04:00			`qemu-io: can't open device TEST_DIR/empty.bochs: Extent size 2147483648 is too large`
bochs: Check extent_size header field (CVE-2014-0142) This fixes two possible division by zero crashes: In bochs_open() and in seek_to_sector(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 2014-03-26 16:05:34 +04:00			`no file open, try 'help open'`

			`== Zero extent size ==`
bochs: Fix catalog size check The old check was off by a factor of 512 and didn't consider cases where we don't get an exact division. This could lead to an out-of-bounds array access in seek_to_sector(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> 2014-04-09 14:10:34 +04:00			`qemu-io: can't open device TEST_DIR/empty.bochs: Extent size must be at least 512`
bochs: Check extent_size header field (CVE-2014-0142) This fixes two possible division by zero crashes: In bochs_open() and in seek_to_sector(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 2014-03-26 16:05:34 +04:00			`no file open, try 'help open'`
qemu-iotests: Support for bochs format Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> 2014-03-26 16:05:30 +04:00			`*** done`