NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2026-08-19 01:24:42 -05:00
Code Issues Packages Projects Releases Wiki Activity

storage_file: bound-check the qcow2v3 header-size read

Browse Source 
qcow2GetExtensions() reads a 4-byte value at offset QCOW2v3_HDR_SIZE (100) for a
version-3 image, but the only upstream length guard (qcow2GetFeatures) requires
just buf_size >= 100. For a probed file of 100-102 bytes this reads up to 3 bytes
past the buffer. Require buf_size >= QCOW2v3_HDR_SIZE + 4 before the read, as the
other probe helpers already do for their offsets.

Signed-off-by: HE WEI（ギカク） <skyexpoc@gmail.com>
This commit is contained in:
HE WEI（ギカク）
2026-07-17 08:27:35 +09:00
committed by hewei-gikaku
parent f74495c7a1
commit 305b6016dd
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/storage_file/storage_file_probe.c
+6 -2
View File
@@ -466,10 +466,14 @@ qcow2GetExtensions(virStorageSource *meta,
g_clear_pointer(&meta->dataFileRaw, g_free);
if (version == 2)
if (version == 2) {
extension_start = QCOW2_HDR_TOTAL_SIZE;
else
} else {
if (buf_size < QCOW2v3_HDR_SIZE + 4)
return -1;
extension_start = virReadBufInt32BE(buf + QCOW2v3_HDR_SIZE);
}
/*
* QCow2 header extensions are stored directly after the header before