[Qemu-devel] [PATCH] fix heap overflow in block-vmdk.c

[Eric Milliken]

It's possible to set a parentFileNameHint argument > 1023 bytes in the
image file, causing an overflow at the strncpy.

diff -ru qemu-0.9.1/block-vmdk.c qemu-0.9.1-p/block-vmdk.c
--- qemu-0.9.1/block-vmdk.c     2008-01-06 14:38:42.000000000 -0500
+++ qemu-0.9.1-p/block-vmdk.c   2008-01-13 14:30:23.000000000 -0500
@@ -342,6 +342,9 @@
         if ((end_name = strchr(p_name,'\"')) == 0)
             return -1;

+        if ((end_name - p_name) > sizeof (s->hd->backing_file) - 1)
+          return -1;
+
         strncpy(s->hd->backing_file, p_name, end_name - p_name);
         if (stat(s->hd->backing_file, &file_buf) != 0) {
             path_combine(parent_img_name, sizeof(parent_img_name),