Re: [Qemu-stable] [Qemu-devel] [PATCH for-2.0 43/47] qcow2: Fix L1 allocation size in qcow2_snapshot_load_tmp() (CVE-2014-0145)

[Max Reitz]

On 26.03.2014 13:06, Stefan Hajnoczi wrote:
> From: Kevin Wolf <address@hidden>
>
> For the L1 table to loaded for an internal snapshot, the code allocated
> only enough memory to hold the currently active L1 table. If the
> snapshot's L1 table is actually larger than the current one, this leads
> to a buffer overflow.
>
> Signed-off-by: Kevin Wolf <address@hidden>
> ---
>   block/qcow2-snapshot.c     |  2 +-
>   tests/qemu-iotests/029     | 18 +++++++++++++++++-
>   tests/qemu-iotests/029.out |  4 ++++
>   3 files changed, 22 insertions(+), 2 deletions(-)

Reviewed-by: Max Reitz <address@hidden>