[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 07/16] block/dmg: process XML plists
From: |
Stefan Hajnoczi |
Subject: |
[Qemu-devel] [PULL 07/16] block/dmg: process XML plists |
Date: |
Fri, 16 Jan 2015 15:37:04 +0000 |
From: Peter Wu <address@hidden>
The format is simple enough to avoid using a full-blown XML parser. It
assumes that all BLKX items begin with the "mish" magic word, therefore
it is not a problem if other values get matched which are not a BLKX
block.
The offsets are based on the description at
http://newosxbook.com/DMG.html
Signed-off-by: Peter Wu <address@hidden>
Reviewed-by: John Snow <address@hidden>
Message-id: address@hidden
Signed-off-by: Stefan Hajnoczi <address@hidden>
---
block/dmg.c | 74 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 74 insertions(+)
diff --git a/block/dmg.c b/block/dmg.c
index 5c2c2c2..d4a7520 100644
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -26,6 +26,7 @@
#include "qemu/bswap.h"
#include "qemu/module.h"
#include <zlib.h>
+#include <glib.h>
enum {
/* Limit chunk sizes to prevent unreasonable amounts of memory being used
@@ -343,12 +344,66 @@ fail:
return ret;
}
+static int dmg_read_plist_xml(BlockDriverState *bs, DmgHeaderState *ds,
+ uint64_t info_begin, uint64_t info_length)
+{
+ BDRVDMGState *s = bs->opaque;
+ int ret;
+ uint8_t *buffer = NULL;
+ char *data_begin, *data_end;
+
+ /* Have at least some length to avoid NULL for g_malloc. Attempt to set a
+ * safe upper cap on the data length. A test sample had a XML length of
+ * about 1 MiB. */
+ if (info_length == 0 || info_length > 16 * 1024 * 1024) {
+ ret = -EINVAL;
+ goto fail;
+ }
+
+ buffer = g_malloc(info_length + 1);
+ buffer[info_length] = '\0';
+ ret = bdrv_pread(bs->file, info_begin, buffer, info_length);
+ if (ret != info_length) {
+ ret = -EINVAL;
+ goto fail;
+ }
+
+ /* look for <data>...</data>. The data is 284 (0x11c) bytes after base64
+ * decode. The actual data element has 431 (0x1af) bytes which includes
tabs
+ * and line feeds. */
+ data_end = (char *)buffer;
+ while ((data_begin = strstr(data_end, "<data>")) != NULL) {
+ gsize out_len = 0;
+
+ data_begin += 6;
+ data_end = strstr(data_begin, "</data>");
+ /* malformed XML? */
+ if (data_end == NULL) {
+ ret = -EINVAL;
+ goto fail;
+ }
+ *data_end++ = '\0';
+ g_base64_decode_inplace(data_begin, &out_len);
+ ret = dmg_read_mish_block(s, ds, (uint8_t *)data_begin,
+ (uint32_t)out_len);
+ if (ret < 0) {
+ goto fail;
+ }
+ }
+ ret = 0;
+
+fail:
+ g_free(buffer);
+ return ret;
+}
+
static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
Error **errp)
{
BDRVDMGState *s = bs->opaque;
DmgHeaderState ds;
uint64_t rsrc_fork_offset, rsrc_fork_length;
+ uint64_t plist_xml_offset, plist_xml_length;
int64_t offset;
int ret;
@@ -382,12 +437,31 @@ static int dmg_open(BlockDriverState *bs, QDict *options,
int flags,
ret = -EINVAL;
goto fail;
}
+ /* offset of property list (XMLOffset) */
+ ret = read_uint64(bs, offset + 0xd8, &plist_xml_offset);
+ if (ret < 0) {
+ goto fail;
+ }
+ ret = read_uint64(bs, offset + 0xe0, &plist_xml_length);
+ if (ret < 0) {
+ goto fail;
+ }
+ if (plist_xml_offset >= offset ||
+ plist_xml_length > offset - plist_xml_offset) {
+ ret = -EINVAL;
+ goto fail;
+ }
if (rsrc_fork_length != 0) {
ret = dmg_read_resource_fork(bs, &ds,
rsrc_fork_offset, rsrc_fork_length);
if (ret < 0) {
goto fail;
}
+ } else if (plist_xml_length != 0) {
+ ret = dmg_read_plist_xml(bs, &ds, plist_xml_offset, plist_xml_length);
+ if (ret < 0) {
+ goto fail;
+ }
} else {
ret = -EINVAL;
goto fail;
--
2.1.0
- [Qemu-devel] [PULL 00/16] Block patches, Stefan Hajnoczi, 2015/01/16
- [Qemu-devel] [PULL 01/16] block: add event when disk usage exceeds threshold, Stefan Hajnoczi, 2015/01/16
- [Qemu-devel] [PULL 02/16] block/dmg: properly detect the UDIF trailer, Stefan Hajnoczi, 2015/01/16
- [Qemu-devel] [PULL 03/16] block/dmg: extract mish block decoding functionality, Stefan Hajnoczi, 2015/01/16
- [Qemu-devel] [PULL 04/16] block/dmg: extract processing of resource forks, Stefan Hajnoczi, 2015/01/16
- [Qemu-devel] [PULL 07/16] block/dmg: process XML plists,
Stefan Hajnoczi <=
- [Qemu-devel] [PULL 05/16] block/dmg: process a buffer instead of reading ints, Stefan Hajnoczi, 2015/01/16
- [Qemu-devel] [PULL 06/16] block/dmg: validate chunk size to avoid overflow, Stefan Hajnoczi, 2015/01/16
- [Qemu-devel] [PULL 10/16] block/dmg: use SectorNumber from BLKX header, Stefan Hajnoczi, 2015/01/16
- [Qemu-devel] [PULL 08/16] block/dmg: set virtual size to a non-zero value, Stefan Hajnoczi, 2015/01/16
- [Qemu-devel] [PULL 12/16] block/dmg: support bzip2 block entry types, Stefan Hajnoczi, 2015/01/16
- [Qemu-devel] [PULL 09/16] block/dmg: fix sector data offset calculation, Stefan Hajnoczi, 2015/01/16
- [Qemu-devel] [PULL 14/16] qed: check for header size overflow, Stefan Hajnoczi, 2015/01/16
- [Qemu-devel] [PULL 11/16] block/dmg: factor out block type check, Stefan Hajnoczi, 2015/01/16
- [Qemu-devel] [PULL 15/16] qemu-iotests: add 116 invalid QED input file tests, Stefan Hajnoczi, 2015/01/16
- [Qemu-devel] [PULL 13/16] block/dmg: improve zeroes handling, Stefan Hajnoczi, 2015/01/16