From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:37891)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <jsnow@redhat.com>) id 1Y7CAs-00037Q-Rg
	for qemu-devel@nongnu.org; Fri, 02 Jan 2015 19:02:35 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <jsnow@redhat.com>) id 1Y7CAs-0000EP-0i
	for qemu-devel@nongnu.org; Fri, 02 Jan 2015 19:02:34 -0500
Received: from mx1.redhat.com ([209.132.183.28]:33601)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <jsnow@redhat.com>) id 1Y7CAr-0000ED-QR
	for qemu-devel@nongnu.org; Fri, 02 Jan 2015 19:02:33 -0500
Message-ID: <54A73196.2070405@redhat.com>
Date: Fri, 02 Jan 2015 19:02:30 -0500
From: John Snow <jsnow@redhat.com>
MIME-Version: 1.0
References: <1419692504-29373-1-git-send-email-peter@lekensteyn.nl>
	<1419692504-29373-6-git-send-email-peter@lekensteyn.nl>
In-Reply-To: <1419692504-29373-6-git-send-email-peter@lekensteyn.nl>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH 05/10] block/dmg: validate chunk size to
 avoid overflow
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Peter Wu <peter@lekensteyn.nl>, qemu-devel@nongnu.org
Cc: Kevin Wolf <kwolf@redhat.com>, Stefan Hajnoczi <stefanha@redhat.com>



On 12/27/2014 10:01 AM, Peter Wu wrote:
> Previously the chunk size was not checked, allowing for a large memory
> allocation. This patch checks whether the chunks size is within the
> resource fork length.
>
> Signed-off-by: Peter Wu <peter@lekensteyn.nl>
> ---
>   block/dmg.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/block/dmg.c b/block/dmg.c
> index 75e771a..19e4fe2 100644
> --- a/block/dmg.c
> +++ b/block/dmg.c
> @@ -308,7 +308,7 @@ static int dmg_read_resource_fork(BlockDriverState *bs, DmgHeaderState *ds,
>           ret = read_uint32(bs, offset, &count);
>           if (ret < 0) {
>               goto fail;
> -        } else if (count == 0) {
> +        } else if (count == 0 || count > info_end - offset) {
>               ret = -EINVAL;
>               goto fail;
>           }
>

As mentioned already, please squash your latest changes in your git 
repository into this patch for v2.