[vbox-dev] vhd crash bug

[Alexander Eichner]

Hi Huihong,

can you provide the parameters vhdRead is called with please?
The value of cBlockAllocationTableEntry, cBATEntryIndex and
pImage->pBlockAllocationTable[cBlockAllocationTableEntry] would be
helpful too.
Thank you very much.

Kind regards,
Alexander Eichner

Am Sonntag, den 14.06.2009, 15:38 -0700 schrieb Huihong Luo:
> I found another critical issue in VHDHDDCore.cpp
>  
> static int vhdRead(void *pBackendData, uint64_t uOffset, void *pvBuf,
> size_t cbRead, size_t *pcbActuallyRead)
> {
>  
>  
> do
> {
>    cSectors++;
>    iBitmap = iBATEntryIndexCurr / 8; /* Byte in the block bitmap. */
>    iBitInByte = (8 - 1) - (iBATEntryIndexCurr % 8);
>    puBitmap = pImage->pu8Bitmap + iBitmap;
>  
>   if (!ASMBitTest(puBitmap, iBitInByte))     <======= THIS CAUSES
> CRASHES
>      break;
>    iBATEntryIndexCurr++;
> } while (cSectors < (cbRead / VHD_SECTOR_SIZE));
>  
> }
>  
> The above code contains a buffer overrun bug. The following is an
> example case, found from my debugger:
>  
> pImage->pu8Bitmap, 0x200 in size (pImage->cbDataBlockBitmap = 0x200)
> iBATEntryIndexCurr = 0xfe8
> iBitmap = 0x1fd
> iBitInByte = 0x7
>  
> ASMBitTest(puBitmap, iBitInByte) will read pImage->pu8Bitmap at offset
> of 0x204 (0x1fd + 0x7), definitely over running the 0x200 buf len.
>  
> This bug is very tough to catch, but it does occur after extensive
> test runs. My guess is that some kind of 8-byte alignment should be
> enforced ?
>  
> Let me know if more info is needed,
>  
> Huihong
>  
>  
>  
> _______________________________________________
> vbox-dev mailing list
> vbox-dev at virtualbox.org
> http://vbox.innotek.de/mailman/listinfo/vbox-dev