From: Stefan Hajnoczi <[email protected]> The dmg block driver expects the disk image file to contain at least one chunk. Refuse to open such files. This ensures that dmg block driver state always has non-NULL s->sectors[] and related fields.
Note that the previous commit fixed the only known way to trigger a crash. This patch is just for defense - let's avoid opening the file and having NULL pointers in dmg block driver state. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4021 Reported-by: Tristan Madani <[email protected]> Signed-off-by: Stefan Hajnoczi <[email protected]> Message-ID: <[email protected]> Reviewed-by: Kevin Wolf <[email protected]> Signed-off-by: Kevin Wolf <[email protected]> --- block/dmg.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/block/dmg.c b/block/dmg.c index e325127d144..6f8120e0338 100644 --- a/block/dmg.c +++ b/block/dmg.c @@ -559,6 +559,12 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags, goto fail; } + /* There must be at least one chunk */ + if (s->n_chunks == 0) { + ret = -EINVAL; + goto fail; + } + /* initialize zlib engine */ s->compressed_chunk = qemu_try_blockalign(bs->file->bs, ds.max_compressed_size + 1); -- 2.55.0
