Out-of-bounds read when processing malformed fixed-size index file

Details

Missing overflow checks when handling the index and chunk size of a fixed-size index could cause a wrong size to be used for mapping the index file, triggering a segfault/crash of proxmox-backup-proxy.

This issue was not exploitable via index files created via the backup API, it requires direct access to a PBS datastore to be triggered.

Fixed-size index files are now restricted to a chunk size of 4MB in the index reader, not just in the backup API.

This issue was found internally.

Fixed in

• proxmox-backup-server >= 4.2.8-1, proxmox-backup-client >= 4.2.8-1