[PATCH] dmg: avoid out-of-bounds memory load in dmg_read_mish_block()

[PATCH] dmg: avoid out-of-bounds memory load in dmg_read_mish_block()

[Stefan Hajnoczi]

dmg_read_mish_block() loads from memory beyond the end of the buffer
when count is less than 4.

There is no known security impact here because dmg_read_mish_block()
returns almost immediately without any opportunity to gain control of
execution or cause other damage. A crash will not happen because it's a
32-bit load from a memory address that was just heap allocated. The
address will be properly aligned and will not span a page of memory.

Reported-by: router0mail <https://gitlab.com/router0mail>
Fixes: 7aee37b93a4f ("block/dmg: process a buffer instead of reading ints")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4569
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/dmg.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/block/dmg.c b/block/dmg.c
index 5d7d3b8901f..412d4bfc354 100644
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -226,9 +226,13 @@ static int dmg_read_mish_block(BDRVDMGState *s, DmgHeaderState *ds,
     uint64_t in_offset = ds->data_fork_offset;
     uint64_t out_offset;
 
+    if (count < 244) {
+        return 0; /* too small, skip silently */
+    }
+
     type = buff_read_uint32(buffer, offset);
-    /* skip data that is not a valid MISH block (invalid magic or too small) */
-    if (type != 0x6d697368 || count < 244) {
+    /* skip data that is not a valid MISH block (invalid magic) */
+    if (type != 0x6d697368) {
         /* assume success for now */
         return 0;
     }
-- 
2.56.0

Re: [PATCH] dmg: avoid out-of-bounds memory load in dmg_read_mish_block()

[Eric Blake]

On Tue, Oct 13, 2026 at 03:37:08PM -0400, Stefan Hajnoczi wrote:
> dmg_read_mish_block() loads from memory beyond the end of the buffer
> when count is less than 4.
> 
> There is no known security impact here because dmg_read_mish_block()
> returns almost immediately without any opportunity to gain control of
> execution or cause other damage. A crash will not happen because it's a
> 32-bit load from a memory address that was just heap allocated. The
> address will be properly aligned and will not span a page of memory.
> 
> Reported-by: router0mail <https://gitlab.com/router0mail>
> Fixes: 7aee37b93a4f ("block/dmg: process a buffer instead of reading ints")
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4569
> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
> ---
>  block/dmg.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/block/dmg.c b/block/dmg.c
> index 5d7d3b8901f..412d4bfc354 100644
> --- a/block/dmg.c
> +++ b/block/dmg.c
> @@ -226,9 +226,13 @@ static int dmg_read_mish_block(BDRVDMGState *s, DmgHeaderState *ds,
>      uint64_t in_offset = ds->data_fork_offset;
>      uint64_t out_offset;
>  
> +    if (count < 244) {
> +        return 0; /* too small, skip silently */
> +    }
> +
>      type = buff_read_uint32(buffer, offset);
> -    /* skip data that is not a valid MISH block (invalid magic or too small) */
> -    if (type != 0x6d697368 || count < 244) {
> +    /* skip data that is not a valid MISH block (invalid magic) */
> +    if (type != 0x6d697368) {
>          /* assume success for now */
>          return 0;
>      }

Reviewed-by: Eric Blake <eblake@redhat.com>

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.
Virtualization:  qemu.org | libguestfs.org