]> git.proxmox.com Git - mirror_qemu.git/blame - block/dmg.c
dmg: sanitize chunk length and sectorcount (CVE-2014-0145)
[mirror_qemu.git] / block / dmg.c
CommitLineData
585d0ed9
FB
1/*
2 * QEMU Block driver for DMG images
5fafdf24 3 *
585d0ed9 4 * Copyright (c) 2004 Johannes E. Schindelin
5fafdf24 5 *
585d0ed9
FB
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
faf07963 24#include "qemu-common.h"
737e150e 25#include "block/block_int.h"
1de7afc9
PB
26#include "qemu/bswap.h"
27#include "qemu/module.h"
585d0ed9
FB
28#include <zlib.h>
29
c165f775
SH
30enum {
31 /* Limit chunk sizes to prevent unreasonable amounts of memory being used
32 * or truncating when converting to 32-bit types
33 */
34 DMG_LENGTHS_MAX = 64 * 1024 * 1024, /* 64 MB */
35 DMG_SECTORCOUNTS_MAX = DMG_LENGTHS_MAX / 512,
36};
37
585d0ed9 38typedef struct BDRVDMGState {
848c66e8 39 CoMutex lock;
585d0ed9
FB
40 /* each chunk contains a certain number of sectors,
41 * offsets[i] is the offset in the .dmg file,
42 * lengths[i] is the length of the compressed chunk,
43 * sectors[i] is the sector beginning at offsets[i],
44 * sectorcounts[i] is the number of sectors in that chunk,
45 * the sectors array is ordered
46 * 0<=i<n_chunks */
47
48 uint32_t n_chunks;
49 uint32_t* types;
50 uint64_t* offsets;
51 uint64_t* lengths;
52 uint64_t* sectors;
53 uint64_t* sectorcounts;
54 uint32_t current_chunk;
28a5c9c8
FB
55 uint8_t *compressed_chunk;
56 uint8_t *uncompressed_chunk;
585d0ed9
FB
57 z_stream zstream;
58} BDRVDMGState;
59
60static int dmg_probe(const uint8_t *buf, int buf_size, const char *filename)
61{
f5866fa4
KW
62 int len;
63
64 if (!filename) {
65 return 0;
66 }
67
68 len = strlen(filename);
69 if (len > 4 && !strcmp(filename + len - 4, ".dmg")) {
70 return 2;
71 }
585d0ed9
FB
72 return 0;
73}
74
69d34a36 75static int read_uint64(BlockDriverState *bs, int64_t offset, uint64_t *result)
585d0ed9 76{
69d34a36
KW
77 uint64_t buffer;
78 int ret;
79
80 ret = bdrv_pread(bs->file, offset, &buffer, 8);
81 if (ret < 0) {
82 return ret;
83 }
84
85 *result = be64_to_cpu(buffer);
86 return 0;
585d0ed9
FB
87}
88
69d34a36 89static int read_uint32(BlockDriverState *bs, int64_t offset, uint32_t *result)
585d0ed9 90{
69d34a36
KW
91 uint32_t buffer;
92 int ret;
93
94 ret = bdrv_pread(bs->file, offset, &buffer, 4);
95 if (ret < 0) {
96 return ret;
97 }
98
99 *result = be32_to_cpu(buffer);
100 return 0;
585d0ed9
FB
101}
102
015a1036
HR
103static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
104 Error **errp)
585d0ed9
FB
105{
106 BDRVDMGState *s = bs->opaque;
2c1885ad 107 uint64_t info_begin, info_end, last_in_offset, last_out_offset;
69d34a36 108 uint32_t count, tmp;
2c1885ad 109 uint32_t max_compressed_size = 1, max_sectors_per_chunk = 1, i;
16cdf7ce 110 int64_t offset;
69d34a36 111 int ret;
585d0ed9 112
585d0ed9
FB
113 bs->read_only = 1;
114 s->n_chunks = 0;
511d2b14 115 s->offsets = s->lengths = s->sectors = s->sectorcounts = NULL;
3b46e624 116
585d0ed9 117 /* read offset of info blocks */
64a31d5c 118 offset = bdrv_getlength(bs->file);
16cdf7ce 119 if (offset < 0) {
69d34a36 120 ret = offset;
1559ca00 121 goto fail;
585d0ed9 122 }
64a31d5c 123 offset -= 0x1d8;
1559ca00 124
69d34a36
KW
125 ret = read_uint64(bs, offset, &info_begin);
126 if (ret < 0) {
127 goto fail;
128 } else if (info_begin == 0) {
129 ret = -EINVAL;
130 goto fail;
16cdf7ce
CH
131 }
132
69d34a36
KW
133 ret = read_uint32(bs, info_begin, &tmp);
134 if (ret < 0) {
135 goto fail;
136 } else if (tmp != 0x100) {
137 ret = -EINVAL;
16cdf7ce
CH
138 goto fail;
139 }
140
69d34a36
KW
141 ret = read_uint32(bs, info_begin + 4, &count);
142 if (ret < 0) {
143 goto fail;
144 } else if (count == 0) {
145 ret = -EINVAL;
16cdf7ce
CH
146 goto fail;
147 }
148 info_end = info_begin + count;
149
150 offset = info_begin + 0x100;
585d0ed9
FB
151
152 /* read offsets */
153 last_in_offset = last_out_offset = 0;
16cdf7ce 154 while (offset < info_end) {
995179f1
FB
155 uint32_t type;
156
69d34a36
KW
157 ret = read_uint32(bs, offset, &count);
158 if (ret < 0) {
159 goto fail;
160 } else if (count == 0) {
161 ret = -EINVAL;
162 goto fail;
163 }
16cdf7ce
CH
164 offset += 4;
165
69d34a36
KW
166 ret = read_uint32(bs, offset, &type);
167 if (ret < 0) {
168 goto fail;
169 }
170
2c1885ad 171 if (type == 0x6d697368 && count >= 244) {
eb71803b
SH
172 size_t new_size;
173 uint32_t chunk_count;
16cdf7ce
CH
174
175 offset += 4;
176 offset += 200;
177
2c1885ad
SH
178 chunk_count = (count - 204) / 40;
179 new_size = sizeof(uint64_t) * (s->n_chunks + chunk_count);
180 s->types = g_realloc(s->types, new_size / 2);
181 s->offsets = g_realloc(s->offsets, new_size);
182 s->lengths = g_realloc(s->lengths, new_size);
183 s->sectors = g_realloc(s->sectors, new_size);
184 s->sectorcounts = g_realloc(s->sectorcounts, new_size);
585d0ed9 185
69d34a36
KW
186 for (i = s->n_chunks; i < s->n_chunks + chunk_count; i++) {
187 ret = read_uint32(bs, offset, &s->types[i]);
188 if (ret < 0) {
189 goto fail;
190 }
2c1885ad
SH
191 offset += 4;
192 if (s->types[i] != 0x80000005 && s->types[i] != 1 &&
193 s->types[i] != 2) {
73ed27ec 194 if (s->types[i] == 0xffffffff && i > 0) {
2c1885ad
SH
195 last_in_offset = s->offsets[i - 1] + s->lengths[i - 1];
196 last_out_offset = s->sectors[i - 1] +
197 s->sectorcounts[i - 1];
198 }
199 chunk_count--;
200 i--;
201 offset += 36;
202 continue;
203 }
204 offset += 4;
16cdf7ce 205
69d34a36
KW
206 ret = read_uint64(bs, offset, &s->sectors[i]);
207 if (ret < 0) {
208 goto fail;
209 }
210 s->sectors[i] += last_out_offset;
211 offset += 8;
16cdf7ce 212
69d34a36
KW
213 ret = read_uint64(bs, offset, &s->sectorcounts[i]);
214 if (ret < 0) {
215 goto fail;
216 }
217 offset += 8;
16cdf7ce 218
c165f775
SH
219 if (s->sectorcounts[i] > DMG_SECTORCOUNTS_MAX) {
220 error_report("sector count %" PRIu64 " for chunk %u is "
221 "larger than max (%u)",
222 s->sectorcounts[i], i, DMG_SECTORCOUNTS_MAX);
223 ret = -EINVAL;
224 goto fail;
225 }
226
69d34a36
KW
227 ret = read_uint64(bs, offset, &s->offsets[i]);
228 if (ret < 0) {
229 goto fail;
230 }
231 s->offsets[i] += last_in_offset;
232 offset += 8;
16cdf7ce 233
69d34a36
KW
234 ret = read_uint64(bs, offset, &s->lengths[i]);
235 if (ret < 0) {
236 goto fail;
237 }
238 offset += 8;
16cdf7ce 239
c165f775
SH
240 if (s->lengths[i] > DMG_LENGTHS_MAX) {
241 error_report("length %" PRIu64 " for chunk %u is larger "
242 "than max (%u)",
243 s->lengths[i], i, DMG_LENGTHS_MAX);
244 ret = -EINVAL;
245 goto fail;
246 }
247
2c1885ad
SH
248 if (s->lengths[i] > max_compressed_size) {
249 max_compressed_size = s->lengths[i];
250 }
251 if (s->sectorcounts[i] > max_sectors_per_chunk) {
252 max_sectors_per_chunk = s->sectorcounts[i];
253 }
254 }
255 s->n_chunks += chunk_count;
256 }
585d0ed9
FB
257 }
258
259 /* initialize zlib engine */
2c1885ad
SH
260 s->compressed_chunk = g_malloc(max_compressed_size + 1);
261 s->uncompressed_chunk = g_malloc(512 * max_sectors_per_chunk);
262 if (inflateInit(&s->zstream) != Z_OK) {
69d34a36
KW
263 ret = -EINVAL;
264 goto fail;
265 }
585d0ed9
FB
266
267 s->current_chunk = s->n_chunks;
3b46e624 268
848c66e8 269 qemu_co_mutex_init(&s->lock);
585d0ed9 270 return 0;
69d34a36 271
1559ca00 272fail:
69d34a36
KW
273 g_free(s->types);
274 g_free(s->offsets);
275 g_free(s->lengths);
276 g_free(s->sectors);
277 g_free(s->sectorcounts);
278 g_free(s->compressed_chunk);
279 g_free(s->uncompressed_chunk);
280 return ret;
585d0ed9
FB
281}
282
283static inline int is_sector_in_chunk(BDRVDMGState* s,
2c1885ad 284 uint32_t chunk_num, int sector_num)
585d0ed9 285{
2c1885ad
SH
286 if (chunk_num >= s->n_chunks || s->sectors[chunk_num] > sector_num ||
287 s->sectors[chunk_num] + s->sectorcounts[chunk_num] <= sector_num) {
288 return 0;
289 } else {
290 return -1;
291 }
585d0ed9
FB
292}
293
2c1885ad 294static inline uint32_t search_chunk(BDRVDMGState *s, int sector_num)
585d0ed9
FB
295{
296 /* binary search */
2c1885ad
SH
297 uint32_t chunk1 = 0, chunk2 = s->n_chunks, chunk3;
298 while (chunk1 != chunk2) {
299 chunk3 = (chunk1 + chunk2) / 2;
300 if (s->sectors[chunk3] > sector_num) {
301 chunk2 = chunk3;
302 } else if (s->sectors[chunk3] + s->sectorcounts[chunk3] > sector_num) {
303 return chunk3;
304 } else {
305 chunk1 = chunk3;
306 }
585d0ed9
FB
307 }
308 return s->n_chunks; /* error */
309}
310
64a31d5c 311static inline int dmg_read_chunk(BlockDriverState *bs, int sector_num)
585d0ed9 312{
64a31d5c
CH
313 BDRVDMGState *s = bs->opaque;
314
2c1885ad
SH
315 if (!is_sector_in_chunk(s, s->current_chunk, sector_num)) {
316 int ret;
317 uint32_t chunk = search_chunk(s, sector_num);
585d0ed9 318
2c1885ad
SH
319 if (chunk >= s->n_chunks) {
320 return -1;
321 }
585d0ed9 322
2c1885ad
SH
323 s->current_chunk = s->n_chunks;
324 switch (s->types[chunk]) {
325 case 0x80000005: { /* zlib compressed */
2c1885ad
SH
326 /* we need to buffer, because only the chunk as whole can be
327 * inflated. */
b404bf85
SH
328 ret = bdrv_pread(bs->file, s->offsets[chunk],
329 s->compressed_chunk, s->lengths[chunk]);
2c1885ad
SH
330 if (ret != s->lengths[chunk]) {
331 return -1;
332 }
333
334 s->zstream.next_in = s->compressed_chunk;
335 s->zstream.avail_in = s->lengths[chunk];
336 s->zstream.next_out = s->uncompressed_chunk;
337 s->zstream.avail_out = 512 * s->sectorcounts[chunk];
338 ret = inflateReset(&s->zstream);
339 if (ret != Z_OK) {
340 return -1;
341 }
342 ret = inflate(&s->zstream, Z_FINISH);
343 if (ret != Z_STREAM_END ||
344 s->zstream.total_out != 512 * s->sectorcounts[chunk]) {
345 return -1;
346 }
347 break; }
348 case 1: /* copy */
349 ret = bdrv_pread(bs->file, s->offsets[chunk],
64a31d5c 350 s->uncompressed_chunk, s->lengths[chunk]);
2c1885ad
SH
351 if (ret != s->lengths[chunk]) {
352 return -1;
353 }
354 break;
355 case 2: /* zero */
356 memset(s->uncompressed_chunk, 0, 512 * s->sectorcounts[chunk]);
357 break;
358 }
359 s->current_chunk = chunk;
585d0ed9
FB
360 }
361 return 0;
362}
363
5fafdf24 364static int dmg_read(BlockDriverState *bs, int64_t sector_num,
585d0ed9
FB
365 uint8_t *buf, int nb_sectors)
366{
367 BDRVDMGState *s = bs->opaque;
368 int i;
369
2c1885ad
SH
370 for (i = 0; i < nb_sectors; i++) {
371 uint32_t sector_offset_in_chunk;
372 if (dmg_read_chunk(bs, sector_num + i) != 0) {
373 return -1;
374 }
375 sector_offset_in_chunk = sector_num + i - s->sectors[s->current_chunk];
376 memcpy(buf + i * 512,
377 s->uncompressed_chunk + sector_offset_in_chunk * 512, 512);
585d0ed9
FB
378 }
379 return 0;
380}
381
2914caa0
PB
382static coroutine_fn int dmg_co_read(BlockDriverState *bs, int64_t sector_num,
383 uint8_t *buf, int nb_sectors)
384{
385 int ret;
386 BDRVDMGState *s = bs->opaque;
387 qemu_co_mutex_lock(&s->lock);
388 ret = dmg_read(bs, sector_num, buf, nb_sectors);
389 qemu_co_mutex_unlock(&s->lock);
390 return ret;
391}
392
585d0ed9
FB
393static void dmg_close(BlockDriverState *bs)
394{
395 BDRVDMGState *s = bs->opaque;
4f8aa2e1
KW
396
397 g_free(s->types);
398 g_free(s->offsets);
399 g_free(s->lengths);
400 g_free(s->sectors);
401 g_free(s->sectorcounts);
402 g_free(s->compressed_chunk);
403 g_free(s->uncompressed_chunk);
404
585d0ed9
FB
405 inflateEnd(&s->zstream);
406}
407
5efa9d5a 408static BlockDriver bdrv_dmg = {
2c1885ad
SH
409 .format_name = "dmg",
410 .instance_size = sizeof(BDRVDMGState),
411 .bdrv_probe = dmg_probe,
412 .bdrv_open = dmg_open,
413 .bdrv_read = dmg_co_read,
414 .bdrv_close = dmg_close,
585d0ed9 415};
5efa9d5a
AL
416
417static void bdrv_dmg_init(void)
418{
419 bdrv_register(&bdrv_dmg);
420}
421
422block_init(bdrv_dmg_init);