mirror of
https://github.com/xemu-project/xemu.git
synced 2025-02-17 10:38:52 +00:00
![aliguori](/assets/img/avatar_default.png)
The bdrv layer uses a signed offset. Furthermore, block-raw-posix only seeks when that offset is positive. Passing a negative offset to block-raw-posix can result in data being written at the current seek cursor's position. It may be possible to exploit this to seek to the end of the disk and extend the virtual disk by writing data to a negative sector offset. After a reboot, this could lead to the guest having a larger disk than it had before. Close the hole by sanity checking the lba against the size of the disk. Signed-off-by: Rik van Riel <riel@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6475 c046a42c-6fe2-441c-8c8c-71466251a162
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
Read the documentation in qemu-doc.html. Fabrice Bellard.
Description
Languages
C
82.5%
C++
7%
Python
3.3%
Dylan
2.8%
Shell
1.5%
Other
2.6%