From: Denis V. Lunev <[email protected]>
The Format Extension offset and the cluster size both come from the
image header and neither is checked against the image file. Reject the
image rather than reading a cluster which is not there.
Fixes: baefd977002e ("parallels: support bitmap extension for read-only mode")
Cc: Stefan Hajnoczi <[email protected]>
Cc: Thomas Huth <[email protected]>
Signed-off-by: Denis V. Lunev <[email protected]>
---
block/parallels.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/block/parallels.c b/block/parallels.c
index 93b5fa9dcd..50748d1415 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -1375,6 +1375,8 @@ static int parallels_open(BlockDriverState *bs, QDict
*options, int flags,
}
if (ph.ext_off) {
+ int64_t ext_off = le64_to_cpu(ph.ext_off);
+
if (flags & BDRV_O_RDWR) {
/*
* It's unsafe to open image RW if there is an extension (as we
@@ -1382,9 +1384,14 @@ static int parallels_open(BlockDriverState *bs, QDict
*options, int flags,
* ignores the extension, so print warning and don't care.
*/
warn_report("Format Extension ignored in RW mode");
+ } else if (ext_off + s->tracks > file_nb_sectors) {
+ error_setg(errp, "Invalid image: Format Extension is outside the "
+ "image file");
+ ret = -EINVAL;
+ goto fail;
} else {
ret = parallels_read_format_extension(
- bs, le64_to_cpu(ph.ext_off) << BDRV_SECTOR_BITS, errp);
+ bs, ext_off << BDRV_SECTOR_BITS, errp);
if (ret < 0) {
goto fail;
}
--
2.53.0
