From: Stefan Hajnoczi <[email protected]> The binary search in search_chunk() uses s->n_chunks as the (inclusive) upper bound. Chunk indices are in the right-open interval [0, s->n_chunks) so it is wrong to search all the way up to s->n_chunks rather than s->n_chunks - 1.
The worst case security scenario I can see is convincing a victim to hotplug a malicious DMG file to a running guest, potentially causing QEMU to crash when loading from memory beyond the end of s->sectors[] or s->sectorscounts[]. This could be a denial of service. Fixes: CVE-2026-65929 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3844 Reported-by: boy juju <[email protected]> Reported-by: Tristan Madani <[email protected]> Signed-off-by: Stefan Hajnoczi <[email protected]> Message-ID: <[email protected]> Reviewed-by: Kevin Wolf <[email protected]> Signed-off-by: Kevin Wolf <[email protected]> --- block/dmg.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/block/dmg.c b/block/dmg.c index 33dcb3a3498..e325127d144 100644 --- a/block/dmg.c +++ b/block/dmg.c @@ -609,7 +609,10 @@ static inline int is_sector_in_chunk(BDRVDMGState *s, static inline uint32_t search_chunk(BDRVDMGState *s, uint64_t sector_num) { /* binary search */ - uint32_t chunk1 = 0, chunk2 = s->n_chunks, chunk3; + uint32_t chunk1 = 0, chunk2 = s->n_chunks - 1, chunk3; + if (s->n_chunks == 0) { + goto err; /* should never happen */ + } while (chunk1 <= chunk2) { chunk3 = (chunk1 + chunk2) / 2; if (s->sectors[chunk3] > sector_num) { -- 2.55.0
