Re: [Qemu-stable] [Qemu-devel] [PATCH for-2.0 11/47] bochs: Check catalog_size header field (CVE-2014-0143)

[Max Reitz]

On 26.03.2014 13:05, Stefan Hajnoczi wrote:
> From: Kevin Wolf <address@hidden>
>
> It should neither become negative nor allow unbounded memory
> allocations. This fixes aborts in g_malloc() and an s->catalog_bitmap
> buffer overflow on big endian hosts.
>
> Signed-off-by: Kevin Wolf <address@hidden>
> Reviewed-by: Stefan Hajnoczi <address@hidden>
> ---
>   block/bochs.c              | 13 +++++++++++++
>   tests/qemu-iotests/078     | 13 +++++++++++++
>   tests/qemu-iotests/078.out | 10 +++++++++-
>   3 files changed, 35 insertions(+), 1 deletion(-)

Reviewed-by: Max Reitz <address@hidden>