儲存庫 vbox 的更動 77773

時間撮記:

2019-3-18 下午10:33:07 (6 年 以前)

作者:

vboxsync

訊息:

Storage/VMDK: Limit the maximum supported descriptor size to avoid allocating excessive amounts of memory later on

檔案:

• trunk/src/VBox/Storage/VMDK.cpp (修改) (2 筆差異)

trunk/src/VBox/Storage/VMDK.cpp

@@ -137 +137 @@
 } SparseExtentHeader;
 #pragma pack()
+
+/** The maximum allowed descriptor size in the extent header in sectors. */
+#define VMDK_SPARSE_DESCRIPTOR_SIZE_MAX UINT64_C(20480) /* 10MB */
 
 /** VMDK capacity for a single chunk when 2G splitting is turned on. Should be
@@ -2584 +2587 @@
     {
         rc = vdIfError(pImage->pIfError, VERR_VD_VMDK_INVALID_HEADER, RT_SRC_POS, N_("VMDK: corrupted by CR/LF translation in '%s'"), pExtent->pszFullname);
+        return rc;
+    }
+    if (RT_LE2H_U64(pHeader->descriptorSize) > VMDK_SPARSE_DESCRIPTOR_SIZE_MAX)
+    {
+        rc = vdIfError(pImage->pIfError, VERR_VD_VMDK_INVALID_HEADER, RT_SRC_POS, N_("VMDK: descriptor size out of bounds (%llu vs %llu) '%s'"),
+                       pExtent->pszFullname, RT_LE2H_U64(pHeader->descriptorSize), VMDK_SPARSE_DESCRIPTOR_SIZE_MAX);
         return rc;
     }