Changeset 77773 in vbox for trunk/src/VBox

Timestamp:

Mar 18, 2019 10:33:07 PM (6 years ago)

Author:

vboxsync

Message:

Storage/VMDK: Limit the maximum supported descriptor size to avoid allocating excessive amounts of memory later on

File:

• trunk/src/VBox/Storage/VMDK.cpp (modified) (2 diffs)

trunk/src/VBox/Storage/VMDK.cpp

@@ -137 +137 @@
 } SparseExtentHeader;
 #pragma pack()
+
+/** The maximum allowed descriptor size in the extent header in sectors. */
+#define VMDK_SPARSE_DESCRIPTOR_SIZE_MAX UINT64_C(20480) /* 10MB */
 
 /** VMDK capacity for a single chunk when 2G splitting is turned on. Should be
@@ -2584 +2587 @@
     {
         rc = vdIfError(pImage->pIfError, VERR_VD_VMDK_INVALID_HEADER, RT_SRC_POS, N_("VMDK: corrupted by CR/LF translation in '%s'"), pExtent->pszFullname);
+        return rc;
+    }
+    if (RT_LE2H_U64(pHeader->descriptorSize) > VMDK_SPARSE_DESCRIPTOR_SIZE_MAX)
+    {
+        rc = vdIfError(pImage->pIfError, VERR_VD_VMDK_INVALID_HEADER, RT_SRC_POS, N_("VMDK: descriptor size out of bounds (%llu vs %llu) '%s'"),
+                       pExtent->pszFullname, RT_LE2H_U64(pHeader->descriptorSize), VMDK_SPARSE_DESCRIPTOR_SIZE_MAX);
         return rc;
     }