Re: [PATCH] block/vpc: Add a sanity check that fixed-size images have the right type

[Hanna Reitz]

On 12.10.21 10:27, Thomas Huth wrote:

The code in vpc.c uses BDRVVPCState->footer.type in various places
to decide whether the image is a fixed-size (VHD_FIXED) or a dynamic
(VHD_DYNAMIC) image. However, we never check that this field really
contains VHD_FIXED if we detected a fixed size image in vpc_open(),
so a wrong value here could cause quite some trouble during runtime.

Suggested-by: Kevin Wolf 
Signed-off-by: Thomas Huth 
---
  block/vpc.c | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)


Thanks, applied to my block branch:

https://gitlab.com/hreitz/qemu/-/commits/block/

Hanna

[PATCH] block/vpc: Add a sanity check that fixed-size images have the right type

[Thomas Huth]

The code in vpc.c uses BDRVVPCState->footer.type in various places
to decide whether the image is a fixed-size (VHD_FIXED) or a dynamic
(VHD_DYNAMIC) image. However, we never check that this field really
contains VHD_FIXED if we detected a fixed size image in vpc_open(),
so a wrong value here could cause quite some trouble during runtime.

Suggested-by: Kevin Wolf 
Signed-off-by: Thomas Huth 
---
 block/vpc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/block/vpc.c b/block/vpc.c
index dc0ad9fcdc..ec55d69360 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -286,7 +286,8 @@ static int vpc_open(BlockDriverState *bs, QDict *options, 
int flags,
 if (ret < 0) {
 goto fail;
 }
-if (strncmp(footer->creator, "conectix", 8)) {
+if (strncmp(footer->creator, "conectix", 8) ||
+be32_to_cpu(footer->type) != VHD_FIXED) {
 error_setg(errp, "invalid VPC image");
 ret = -EINVAL;
 goto fail;
-- 
2.27.0