libvirt/CVE-2010-223x-0002.patch

>From 66c633413960e869a15062cee8667db51e6c817a Mon Sep 17 00:00:00 2001
From: Daniel P. Berrange <berrange@redhat.com>
Date: Mon, 14 Jun 2010 16:39:32 +0100
Subject: [PATCH 02/10] Remove 'type' field from FileTypeInfo struct

Instead of including a field in FileTypeInfo struct for the
disk format, rely on the array index matching the format.
Use verify() to assert the correct number of elements in the
array.

* src/util/storage_file.c: remove type field from FileTypeInfo
---
 src/util/storage_file.c |  108 +++++++++++++++++++++++-----------------------
 1 files changed, 54 insertions(+), 54 deletions(-)

Index: libvirt-0.8.1/src/util/storage_file.c
===================================================================
--- libvirt-0.8.1.orig/src/util/storage_file.c
+++ libvirt-0.8.1/src/util/storage_file.c
@@ -51,7 +51,6 @@ enum {
 
 /* Either 'magic' or 'extension' *must* be provided */
 struct FileTypeInfo {
-    int type;           /* One of the constants above */
     const char *magic;  /* Optional string of file magic
                          * to check at head of file */
     const char *extension; /* Optional file extension to check */
@@ -86,60 +85,59 @@ static int vmdk4GetBackingStore(char **,
 
 
 static struct FileTypeInfo const fileTypeInfo[] = {
-    /* Bochs */
-    /* XXX Untested
-    { VIR_STORAGE_FILE_BOCHS, "Bochs Virtual HD Image", NULL,
-      LV_LITTLE_ENDIAN, 64, 0x20000,
-      32+16+16+4+4+4+4+4, 8, 1, -1, NULL },*/
-    /* CLoop */
-    /* XXX Untested
-    { VIR_STORAGE_VOL_CLOOP, "#!/bin/sh\n#V2.0 Format\nmodprobe cloop file=$0 && mount -r -t iso9660 /dev/cloop $1\n", NULL,
-      LV_LITTLE_ENDIAN, -1, 0,
-      -1, 0, 0, -1, NULL }, */
-    /* Cow */
-    { VIR_STORAGE_FILE_COW, "OOOM", NULL,
-      LV_BIG_ENDIAN, 4, 2,
-      4+4+1024+4, 8, 1, -1, cowGetBackingStore },
-    /* DMG */
-    /* XXX QEMU says there's no magic for dmg, but we should check... */
-    { VIR_STORAGE_FILE_DMG, NULL, ".dmg",
-      0, -1, 0,
-      -1, 0, 0, -1, NULL },
-    /* XXX there's probably some magic for iso we can validate too... */
-    { VIR_STORAGE_FILE_ISO, NULL, ".iso",
-      0, -1, 0,
-      -1, 0, 0, -1, NULL },
-    /* Parallels */
-    /* XXX Untested
-    { VIR_STORAGE_FILE_PARALLELS, "WithoutFreeSpace", NULL,
-      LV_LITTLE_ENDIAN, 16, 2,
-      16+4+4+4+4, 4, 512, -1, NULL },
-    */
-    /* QCow */
-    { VIR_STORAGE_FILE_QCOW, "QFI", NULL,
-      LV_BIG_ENDIAN, 4, 1,
-      4+4+8+4+4, 8, 1, 4+4+8+4+4+8+1+1+2, qcow1GetBackingStore },
-    /* QCow 2 */
-    { VIR_STORAGE_FILE_QCOW2, "QFI", NULL,
-      LV_BIG_ENDIAN, 4, 2,
-      4+4+8+4+4, 8, 1, 4+4+8+4+4+8, qcow2GetBackingStore },
-    /* VMDK 3 */
-    /* XXX Untested
-    { VIR_STORAGE_FILE_VMDK, "COWD", NULL,
-      LV_LITTLE_ENDIAN, 4, 1,
-      4+4+4, 4, 512, -1, NULL },
-    */
-    /* VMDK 4 */
-    { VIR_STORAGE_FILE_VMDK, "KDMV", NULL,
-      LV_LITTLE_ENDIAN, 4, 1,
-      4+4+4, 8, 512, -1, vmdk4GetBackingStore },
-    /* Connectix / VirtualPC */
-    /* XXX Untested
-    { VIR_STORAGE_FILE_VPC, "conectix", NULL,
-      LV_BIG_ENDIAN, -1, 0,
-      -1, 0, 0, -1, NULL},
-    */
+    [VIR_STORAGE_FILE_RAW] = { NULL, NULL, LV_LITTLE_ENDIAN, 0, 0, 0, 0, 0, 0, NULL },
+    [VIR_STORAGE_FILE_DIR] = { NULL, NULL, LV_LITTLE_ENDIAN, 0, 0, 0, 0, 0, 0, NULL },
+    [VIR_STORAGE_FILE_BOCHS] = {
+        /*"Bochs Virtual HD Image", */ /* Untested */ NULL,
+        NULL,
+        LV_LITTLE_ENDIAN, 64, 0x20000,
+        32+16+16+4+4+4+4+4, 8, 1, -1, NULL
+    },
+    [VIR_STORAGE_FILE_CLOOP] = {
+        /*"#!/bin/sh\n#V2.0 Format\nmodprobe cloop file=$0 && mount -r -t iso9660 /dev/cloop $1\n", */ /* Untested */ NULL,
+        NULL,
+        LV_LITTLE_ENDIAN, -1, 0,
+        -1, 0, 0, -1, NULL
+    },
+    [VIR_STORAGE_FILE_COW] = {
+        "OOOM", NULL,
+        LV_BIG_ENDIAN, 4, 2,
+        4+4+1024+4, 8, 1, -1, cowGetBackingStore
+    },
+    [VIR_STORAGE_FILE_DMG] = {
+        NULL, /* XXX QEMU says there's no magic for dmg, but we should check... */
+        ".dmg",
+        0, -1, 0,
+        -1, 0, 0, -1, NULL
+    },
+    [VIR_STORAGE_FILE_ISO] = {
+        NULL, /* XXX there's probably some magic for iso we can validate too... */
+        ".iso",
+        0, -1, 0,
+        -1, 0, 0, -1, NULL
+    },
+    [VIR_STORAGE_FILE_QCOW] = {
+        "QFI", NULL,
+        LV_BIG_ENDIAN, 4, 1,
+        4+4+8+4+4, 8, 1, 4+4+8+4+4+8+1+1+2, qcow1GetBackingStore
+    },
+    [VIR_STORAGE_FILE_QCOW2] = {
+        "QFI", NULL,
+        LV_BIG_ENDIAN, 4, 2,
+        4+4+8+4+4, 8, 1, 4+4+8+4+4+8, qcow2GetBackingStore
+    },
+    [VIR_STORAGE_FILE_VMDK] = {
+        "KDMV", NULL,
+        LV_LITTLE_ENDIAN, 4, 1,
+        4+4+4, 8, 512, -1, vmdk4GetBackingStore
+    },
+    [VIR_STORAGE_FILE_VPC] = {
+        "conectix", NULL,
+        LV_BIG_ENDIAN, 12, 0x10000,
+        8 + 4 + 4 + 8 + 4 + 4 + 2 + 2 + 4, 8, 1, -1, NULL
+    },
 };
+verify(ARRAY_CARDINALITY(fileTypeInfo) == VIR_STORAGE_FILE_LAST);
 
 static int
 cowGetBackingStore(char **res,
@@ -485,7 +483,7 @@ virStorageFileGetMetadataFromFD(const ch
         }
 
         /* Validation passed, we know the file format now */
-        meta->format = fileTypeInfo[i].type;
+        meta->format = i;
         if (fileTypeInfo[i].getBackingStore != NULL) {
             char *backing;
             int backingFormat;
@@ -525,7 +523,7 @@ virStorageFileGetMetadataFromFD(const ch
         if (!virFileHasSuffix(path, fileTypeInfo[i].extension))
             continue;
 
-        meta->format = fileTypeInfo[i].type;
+        meta->format = i;
         return 0;
     }