Changeset 20695 in vbox

Timestamp:

Jun 18, 2009 5:08:08 PM (16 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

48800

Message:

VHD: Fix access beyond the block bitmap which can lead to arbitrary crashes

File:

• trunk/src/VBox/Devices/Storage/VHDHDDCore.cpp (modified) (3 diffs)

trunk/src/VBox/Devices/Storage/VHDHDDCore.cpp

@@ -956 +956 @@
                 uint32_t iBATEntryIndexCurr = cBATEntryIndex + 1;
 
+                cSectors = 1;
+
                 /*
                  * The first sector being read is marked dirty, read as much as we
@@ -961 +963 @@
                  * must be read from child.
                  */
-                do
+                while (cSectors < (cbRead / VHD_SECTOR_SIZE))
                 {
-                    cSectors++;
 
                     iBitmap    = iBATEntryIndexCurr / 8; /* Byte in the block bitmap. */
                     iBitInByte = (8 - 1) - (iBATEntryIndexCurr % 8);
                     puBitmap  = pImage->pu8Bitmap + iBitmap;
+                    AssertMsg(puBitmap < (pImage->pu8Bitmap + pImage->cbDataBlockBitmap),
+                              ("VHD: Current bitmap position exceeds maximum size of the bitmap\n"));
                     if (!ASMBitTest(puBitmap, iBitInByte))
                         break;
 
                     iBATEntryIndexCurr++;
-                } while (cSectors < (cbRead / VHD_SECTOR_SIZE));
+                    cSectors++;
+                }
 
                 cbRead = cSectors * VHD_SECTOR_SIZE;
@@ -991 +995 @@
                  * should be read from the parent.
                  */
-                do
+
+                cSectors = 1;
+
+                while (cSectors < (cbRead / VHD_SECTOR_SIZE))
                 {
-                    cSectors++;
-
                     iBitmap    = iBATEntryIndexCurr / 8; /* Byte in the block bitmap. */
                     iBitInByte = (8 - 1) - (iBATEntryIndexCurr % 8);
                     puBitmap  = pImage->pu8Bitmap + iBitmap;
+                    AssertMsg(puBitmap < (pImage->pu8Bitmap + pImage->cbDataBlockBitmap),
+                              ("VHD: Current bitmap position exceeds maximum size of the bitmap\n"));
                     if (ASMBitTest(puBitmap, iBitInByte))
                         break;
 
                     iBATEntryIndexCurr++;
-                } while (cSectors < (cbRead / VHD_SECTOR_SIZE));
+                    cSectors++;
+                }
 
                 cbRead = cSectors * VHD_SECTOR_SIZE;