dmg_read_mish_block() loads from memory beyond the end of the buffer when count is less than 4.
There is no known security impact here because dmg_read_mish_block() returns almost immediately without any opportunity to gain control of execution or cause other damage. A crash will not happen because it's a 32-bit load from a memory address that was just heap allocated. The address will be properly aligned and will not span a page of memory. Reported-by: router0mail <https://gitlab.com/router0mail> Signed-off-by: Stefan Hajnoczi <[email protected]> Reviewed-by: Eric Blake <[email protected]> Message-id: [email protected] Fixes: 7aee37b93a4f ("block/dmg: process a buffer instead of reading ints") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4569 Signed-off-by: Stefan Hajnoczi <[email protected]> --- block/dmg.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/block/dmg.c b/block/dmg.c index 5d7d3b8901f..412d4bfc354 100644 --- a/block/dmg.c +++ b/block/dmg.c @@ -226,9 +226,13 @@ static int dmg_read_mish_block(BDRVDMGState *s, DmgHeaderState *ds, uint64_t in_offset = ds->data_fork_offset; uint64_t out_offset; + if (count < 244) { + return 0; /* too small, skip silently */ + } + type = buff_read_uint32(buffer, offset); - /* skip data that is not a valid MISH block (invalid magic or too small) */ - if (type != 0x6d697368 || count < 244) { + /* skip data that is not a valid MISH block (invalid magic) */ + if (type != 0x6d697368) { /* assume success for now */ return 0; } -- 2.56.0
