Re: [PATCH for-11.1 1/3] dmg: fix out-of-bounds load in search_chunk() (CVE-2026-65929)

[Kevin Wolf <kwolf@redhat.com>]

Am 23.07.2026 um 16:45 hat Stefan Hajnoczi geschrieben:
> The binary search in search_chunk() uses s->n_chunks as the (inclusive)
> upper bound. Chunk indices are in the right-open interval [0,
> s->n_chunks) so it is wrong to search all the way up to s->n_chunks
> rather than s->n_chunks - 1.
> 
> The worst case security scenario I can see is convincing a victim to
> hotplug a malicious DMG file to a running guest, potentially causing
> QEMU to crash when loading from memory beyond the end of s->sectors[] or
> s->sectorscounts[]. This could be a denial of service.
> 
> Fixes: CVE-2026-65929
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3844
> Reported-by: boy juju <agx1657748706@gmail.com>
> Reported-by: Tristan Madani <tristan@talencesecurity.com>
> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
> ---
>  block/dmg.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/block/dmg.c b/block/dmg.c
> index 33dcb3a3498..e325127d144 100644
> --- a/block/dmg.c
> +++ b/block/dmg.c
> @@ -609,7 +609,10 @@ static inline int is_sector_in_chunk(BDRVDMGState *s,
>  static inline uint32_t search_chunk(BDRVDMGState *s, uint64_t sector_num)
>  {
>      /* binary search */
> -    uint32_t chunk1 = 0, chunk2 = s->n_chunks, chunk3;
> +    uint32_t chunk1 = 0, chunk2 = s->n_chunks - 1, chunk3;
> +    if (s->n_chunks == 0) {
> +        goto err; /* should never happen */
> +    }
>      while (chunk1 <= chunk2) {
>          chunk3 = (chunk1 + chunk2) / 2;
>          if (s->sectors[chunk3] > sector_num) {

Fair enough to keep the fix minimal here, but is there any justification
for manually implementing binary search instead of using bsearch()? If
not, this could be a follow-up cleanup.

Kevin