The len variable is a signed integer, therefore it may overflow when reading the backing file name length from the qcow2 image header. This case should be handled explicitly.
Signed-off-by: Max Reitz <mre...@redhat.com> --- block/qcow2.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/block/qcow2.c b/block/qcow2.c index 9c29e1a..e54176e 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -630,6 +630,11 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags, /* read the backing file name */ if (header.backing_file_offset != 0) { len = header.backing_file_size; + if (len < 0) { + error_setg(errp, "Backing file name length is negative"); + ret = -EINVAL; + goto fail; + } if (len > 1023) { len = 1023; } -- 1.8.4.2