Go to file
Stefan Hajnoczi d65f97a82c block/cloop: validate block_size header field (CVE-2014-0144)
Avoid unbounded s->uncompressed_block memory allocation by checking that
the block_size header field has a reasonable value.  Also enforce the
assumption that the value is a non-zero multiple of 512.

These constraints conform to cloop 2.639's code so we accept existing
image files.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01 13:59:47 +02:00
audio Add the ability to vary Spice playback and record rates, to facilitate Opus support. 2014-02-03 11:05:15 +01:00
backends backends/baum.c: Fix compilation when SDL is not available. 2014-03-24 17:47:29 +00:00
block block/cloop: validate block_size header field (CVE-2014-0144) 2014-04-01 13:59:47 +02:00
bsd-user cpu: Move opaque field from CPU_COMMON to CPUState 2014-03-13 19:20:47 +01:00
default-configs Add Enhanced Three-Speed Ethernet Controller (eTSEC) 2014-03-05 03:06:45 +01:00
disas libvixl: Fix format strings for several int64_t values 2014-03-10 14:56:29 +00:00
docs Docs: Introduce multiport serial support in qemupciserial.inf. 2014-03-12 15:03:42 +00:00
dtc@bc895d6d09 dtc: add submodule 2013-04-18 13:50:53 +02:00
fpu softfloat: export squash_input_denormal functions 2014-03-17 16:31:51 +00:00
fsdev hw/9pfs: Include virtio-9p-device.o in build 2014-03-04 09:20:49 +05:30
gdb-xml target-arm: Support fp registers in gdb stub 2013-12-17 19:42:32 +00:00
hw pci: Fix clearing IRQs on reset 2014-03-31 19:53:34 +01:00
include cpu: Avoid QOM casts for CPU() 2014-03-31 19:28:38 +02:00
libcacard Add a 'name' parameter to qemu_thread_create 2014-03-09 21:09:38 +02:00
linux-headers update linux headers to kvm/next 2014-02-27 09:50:45 +01:00
linux-user linux-user: remove duplicate statement 2014-03-27 19:22:49 +04:00
net net: netmap_poll must update both read/write poll state 2014-03-25 13:31:38 +01:00
pc-bios prep: Update ppc_rom.bin 2014-03-13 20:15:37 +01:00
pixman@97336fad32 qapi: move include files to include/qobject/ 2012-12-19 08:31:31 +01:00
po po: Update all *.po files 2013-08-07 12:48:00 -05:00
qapi qapi: Add missing null check to opts_start_struct() 2014-03-03 11:17:45 -05:00
qga qga: Remove unneeded include file 2014-03-03 09:46:27 +04:00
qobject qdict: Extract non-QDicts in qdict_array_split() 2014-02-21 22:11:23 +01:00
qom qom: Add check() argument to object_property_add_link() 2014-03-19 22:23:13 +01:00
roms prep: Update ppc_rom.bin 2014-03-13 20:15:37 +01:00
scripts make-release: Record SeaBIOS version 2014-03-31 15:02:04 +01:00
slirp Fixed various typos 2014-03-25 14:09:50 +01:00
stubs blockdev: Refuse to open encrypted image unless paused 2014-03-14 16:24:42 +01:00
sysconfigs/target Eliminate cpus-x86_64.conf file 2012-09-21 15:12:58 +02:00
target-alpha target-alpha: fix subl and s8subl indentation 2014-03-17 13:21:12 +01:00
target-arm target-arm: Add missing 'static' attribute 2014-03-27 19:22:48 +04:00
target-cris cputlb: Change tlb_set_page() argument to CPUState 2014-03-13 19:52:47 +01:00
target-i386 target-i386: x86_cpu_get_phys_page_debug(): support 1GB page translation 2014-03-31 19:06:48 +02:00
target-lm32 cputlb: Change tlb_set_page() argument to CPUState 2014-03-13 19:52:47 +01:00
target-m68k cputlb: Change tlb_set_page() argument to CPUState 2014-03-13 19:52:47 +01:00
target-microblaze cputlb: Change tlb_set_page() argument to CPUState 2014-03-13 19:52:47 +01:00
target-mips target-mips: Avoid shifting left into sign bit 2014-03-27 19:22:49 +04:00
target-moxie cputlb: Change tlb_set_page() argument to CPUState 2014-03-13 19:52:47 +01:00
target-openrisc cputlb: Change tlb_set_page() argument to CPUState 2014-03-13 19:52:47 +01:00
target-ppc target-ppc: MSR_POW not supported on POWER7/7+/8 2014-03-27 16:15:34 +01:00
target-s390x target-s390x: Add missing 'static' and 'const' attributes 2014-03-27 19:22:48 +04:00
target-sh4 cputlb: Change tlb_set_page() argument to CPUState 2014-03-13 19:52:47 +01:00
target-sparc target-sparc: fix 32bit integer division overflow 2014-03-26 23:40:40 +00:00
target-unicore32 cputlb: Change tlb_set_page() argument to CPUState 2014-03-13 19:52:47 +01:00
target-xtensa cputlb: Change tlb_set_page() argument to CPUState 2014-03-13 19:52:47 +01:00
tcg tcg-arm: Avoid ldrd/strd for user-only emulation 2014-03-27 16:33:01 -04:00
tests block/cloop: validate block_size header field (CVE-2014-0144) 2014-04-01 13:59:47 +02:00
trace osdep: initialize glib threads in all QEMU tools 2014-03-25 13:39:31 +01:00
ui gtk: Support GTK without VTE 2014-03-26 05:33:02 +01:00
util acpi,pc,build bug fixes 2014-03-28 13:46:29 +00:00
.exrc qemu: add .exrc 2012-09-07 09:02:44 +03:00
.gitignore Add qga/qapi-generated to .gitignore 2014-03-15 13:54:18 +04:00
.gitmodules Add OpenHack'Ware submodule 2014-03-12 17:26:32 +01:00
.mailmap Update mailmap 2013-09-05 09:40:31 -05:00
.travis.yml .travis.yml: add IRC notifications for build failures 2014-03-15 13:54:18 +04:00
aio-posix.c aio: make aio_poll(ctx, true) block with no fds 2013-12-06 16:53:51 +01:00
aio-win32.c aio: make aio_poll(ctx, true) block with no fds 2013-12-06 16:53:51 +01:00
arch_init.c XBZRLE: Fix qemu crash when resize the xbzrle cache 2014-03-08 22:22:34 +01:00
async.c aio: add aio_context_acquire() and aio_context_release() 2014-03-13 14:42:24 +01:00
balloon.c softmmu: move include files to include/sysemu/ 2012-12-19 08:32:45 +01:00
block-migration.c block: per caller dirty bitmap 2013-11-29 13:40:33 +01:00
block.c block: Add error handling to bdrv_invalidate_cache() 2014-03-19 09:39:41 +01:00
blockdev-nbd.c nbd: use BlockDriverState refcnt 2013-09-06 15:25:08 +02:00
blockdev.c blockdev: Fix NULL pointer dereference in blockdev-add 2014-03-06 17:27:28 +01:00
blockjob.c Use error_is_set() only when necessary 2014-02-17 11:57:23 -05:00
bt-host.c sysemu: avoid proliferation of include/ subdirectories 2013-04-15 18:19:25 +02:00
bt-vhci.c sysemu: avoid proliferation of include/ subdirectories 2013-04-15 18:19:25 +02:00
Changelog Use qemu-project.org domain name 2013-10-11 09:34:56 -07:00
CODING_STYLE CODING_STYLE: Section about mixed declarations 2014-03-27 19:22:49 +04:00
configure configure: add option to disable -fstack-protector flags 2014-03-31 20:16:02 +01:00
COPYING
COPYING.LIB
coroutine-gthread.c block: move include files to include/block/ 2012-12-19 08:31:31 +01:00
coroutine-sigaltstack.c Merge remote-tracking branch 'kwolf/for-anthony' into staging 2013-02-26 07:44:39 -06:00
coroutine-ucontext.c Fix warnings suppressors to honor --disable-werror 2013-04-17 10:28:04 -05:00
coroutine-win32.c block: move include files to include/block/ 2012-12-19 08:31:31 +01:00
cpu-exec.c cpu-exec: Change cpu_resume_from_signal() argument to CPUState 2014-03-13 19:20:48 +01:00
cpus.c cpu: Move icount_decr field from CPU_COMMON to CPUState 2014-03-13 19:20:46 +01:00
cputlb.c cputlb: Change tlb_set_page() argument to CPUState 2014-03-13 19:52:47 +01:00
device_tree.c device_tree: qemu_fdt_setprop: Rename val_array arg 2013-12-20 01:58:12 +01:00
device-hotplug.c hw/boards: Convert current_machine to MachineState 2014-03-12 20:13:02 +01:00
disas.c disas: Implement disassembly output for A64 2014-02-08 14:50:48 +00:00
dma-helpers.c aio / timers: Untangle include files 2013-08-22 19:10:27 +02:00
dump.c dump: add 'query-dump-guest-memory-capability' command 2014-02-28 11:52:03 -05:00
exec.c exec: Fix CPU rework fallout 2014-03-19 19:47:15 +01:00
gdbstub.c exec: Change cpu_breakpoint_{insert,remove{,_by_ref,_all}} argument 2014-03-13 19:20:48 +01:00
HACKING HACKING: Document vaddr type usage 2013-07-23 02:41:31 +02:00
hmp-commands.hx block: update block commit documentation regarding image truncation 2014-01-24 16:12:49 +01:00
hmp.c dump: make kdump-compressed format available for 'dump-guest-memory' 2014-02-28 11:52:03 -05:00
hmp.h monitor: add object-add (QMP) and object_add (HMP) command 2014-01-06 13:45:47 -05:00
iohandler.c iohandler: switch to GPollFD 2013-02-21 16:17:31 -06:00
ioport.c portio: Allow to mark portio lists as coalesced MMIO flushing 2013-10-17 17:24:15 +02:00
iothread.c qmp: add query-iothreads command 2014-03-13 14:42:24 +01:00
kvm-all.c fix return check for KVM_GET_DIRTY_LOG ioctl 2014-03-27 19:22:48 +04:00
kvm-stub.c Revert "KVM: Split QEMUMachine typedef into separate header" 2014-03-13 03:49:48 +01:00
LICENSE LICENSE: clarify 2013-08-12 09:15:12 -05:00
main-loop.c main-loop: Suppress "I/O thread spun" warnings for qtest 2014-03-13 21:36:50 +01:00
MAINTAINERS acpi,pc,pci,virtio,memory bug fixes 2014-03-10 19:14:11 +00:00
Makefile Makefile: Fix "make clean" 2014-03-17 11:50:19 +00:00
Makefile.objs iothread: add I/O thread object 2014-03-13 14:42:24 +01:00
Makefile.target build: softmmu targets do not have a "main.o" file 2014-02-20 13:14:18 +01:00
memory_mapping.c cpu: Use QTAILQ for CPU list 2013-09-03 12:25:55 +02:00
memory.c memory_region_present: return false if address is not found in child MemoryRegion 2014-03-09 21:09:37 +02:00
migration-exec.c aio / timers: Untangle include files 2013-08-22 19:10:27 +02:00
migration-fd.c aio / timers: Untangle include files 2013-08-22 19:10:27 +02:00
migration-rdma.c rdma: rename 'x-rdma' => 'rdma' 2014-02-25 14:30:28 +01:00
migration-tcp.c aio / timers: Untangle include files 2013-08-22 19:10:27 +02:00
migration-unix.c aio / timers: Untangle include files 2013-08-22 19:10:27 +02:00
migration.c migration: add more traces 2014-03-27 15:19:00 +05:30
module-common.c module: implement module loading 2014-02-20 13:14:18 +01:00
monitor.c input: mouse: switch monitor to new core 2014-03-05 09:52:03 +01:00
nbd.c nbd: move socket wrappers to qemu-nbd 2014-02-21 21:02:23 +01:00
os-posix.c oslib-posix: Fix build on FreeBSD 2014-03-13 14:34:16 +00:00
os-win32.c util: Split out exec_dir from os_find_datadir 2014-02-20 13:12:54 +01:00
page_cache.c Fix two XBZRLE corruption issues 2014-02-25 14:30:28 +01:00
qapi-schema.json virtio-net: add vlan receive state to RxFilterInfo 2014-03-26 12:49:10 +02:00
qdev-monitor.c qdev-monitor: Set properties after parent is assigned in device_add 2014-03-12 20:13:02 +01:00
qdict-test-data.txt
qemu-bridge-helper.c qemu-bridge-helper: force usage of a very high MAC address for the bridge 2013-03-28 12:58:52 -05:00
qemu-char.c char: restore read callback on a reattached (hotplug) chardev 2014-03-13 10:33:45 +01:00
qemu-coroutine-io.c aio / timers: Untangle include files 2013-08-22 19:10:27 +02:00
qemu-coroutine-lock.c coroutine: remove qemu_co_queue_wait_insert_head 2013-12-02 17:11:49 +01:00
qemu-coroutine-sleep.c coroutine: add co_aio_sleep_ns() to allow sleep in block drivers 2013-10-30 12:22:09 +01:00
qemu-coroutine.c coroutine: add ./configure --disable-coroutine-pool 2013-09-12 10:12:48 +02:00
qemu-doc.texi doc: update default PowerPC framebuffer settings 2014-03-27 19:22:49 +04:00
qemu-file.c migration: add more traces 2014-03-27 15:19:00 +05:30
qemu-img-cmds.hx qemu-img: add -l for snapshot in convert 2013-12-04 15:19:00 +01:00
qemu-img.c qemu-img: Release reference to BlockDriverState 2014-04-01 13:49:53 +02:00
qemu-img.texi Describe flaws in qcow/qcow2 encryption in the docs 2014-01-31 22:05:03 +01:00
qemu-io-cmds.c qemu-io-cmds: Fixed typo in example for writev. 2014-03-19 09:39:41 +01:00
qemu-io.c qemu-io: Extended "--cmd" description in usage text 2014-03-19 09:39:41 +01:00
qemu-log.c qemu-log: default to stderr for logging output 2013-02-26 13:31:47 -06:00
qemu-nbd.c qemu-nbd: Fix coverity issues 2014-03-17 13:21:11 +01:00
qemu-nbd.texi qemu-nbd: add doc for option -f 2013-12-04 15:19:00 +01:00
qemu-options-wrapper.h vl.c: In qemu -h output, only print options for the arch we are running as 2011-12-19 10:27:33 -06:00
qemu-options.h vl.c: Move option generation logic into a wrapper file 2011-12-19 10:27:33 -06:00
qemu-options.hx doc: update sun4m documentation 2014-03-27 19:22:48 +04:00
qemu-seccomp.c seccomp: add some basic shared memory syscalls to the whitelist 2014-01-20 11:19:34 -02:00
qemu-tech.texi qemu-tech.texi: update implemented xtensa features list 2012-11-29 13:00:52 -06:00
qemu-timer.c timer: add timer_mod_anticipate and timer_mod_anticipate_ns 2013-10-17 17:31:00 +02:00
qemu.nsi nsis: Improved support for parallel installation of 32 and 64 bit code 2013-11-07 07:02:44 +01:00
qemu.sasl sasl: Avoid 'Could not find keytab file' in syslog 2014-03-15 13:54:18 +04:00
qmp-commands.hx virtio-net: add vlan receive state to RxFilterInfo 2014-03-26 12:49:10 +02:00
qmp.c hw/boards: Convert current_machine to MachineState 2014-03-12 20:13:02 +01:00
qtest.c kvm: Add a new machine option kvm-type 2014-03-05 03:06:24 +01:00
README Use qemu-project.org domain name 2013-10-11 09:34:56 -07:00
rules.mak rules.mak: Fix per object libs extraction 2014-03-17 13:21:11 +01:00
savevm.c migration: add more traces 2014-03-27 15:19:00 +05:30
spice-qemu-char.c spice: hook qemu_chr_fe_set_open() event to ports 2014-02-03 11:05:15 +01:00
tcg-runtime.c tcg: Implement multiword multiply helpers 2013-02-23 17:25:28 +00:00
tci.c misc: Use new rotate functions 2013-09-25 21:23:05 +02:00
thread-pool.c Add a 'name' parameter to qemu_thread_create 2014-03-09 21:09:38 +02:00
thunk.c exec: move include files to include/exec/ 2012-12-19 08:31:31 +01:00
tpm.c Use error_is_set() only when necessary 2014-02-17 11:57:23 -05:00
trace-events migration: add more traces 2014-03-27 15:19:00 +05:30
translate-all.c exec: Change cpu_abort() argument to CPUState 2014-03-13 19:52:28 +01:00
translate-all.h translate-all: Change tb_check_watchpoint() argument to CPUState 2014-03-13 19:20:48 +01:00
user-exec.c user-exec: Change exception_action() argument to CPUState 2014-03-13 19:52:48 +01:00
VERSION Update version for v2.0-rc0 2014-03-13 20:08:15 -07:00
version.rc Use qemu-project.org domain name 2013-10-11 09:34:56 -07:00
vl.c vl.c: Improve message when no default machine is found 2014-03-27 14:01:13 +00:00
vmstate.c migration: add more traces 2014-03-27 15:19:00 +05:30
xbzrle.c Move XBZRLE encoding code to a separate file to allow testing 2013-02-01 08:32:20 +01:00
xen-all.c kvm: Add a new machine option kvm-type 2014-03-05 03:06:24 +01:00
xen-mapcache.c hw: move headers to include/ 2013-04-08 18:13:10 +02:00
xen-stub.c kvm: Add a new machine option kvm-type 2014-03-05 03:06:24 +01:00

Read the documentation in qemu-doc.html or on http://wiki.qemu-project.org

- QEMU team