Re: [PATCH 0/5] block/vmdk: Fix various bugs in handling malicious image files

[Kevin Wolf <kwolf@redhat.com>]

Am 03.11.2026 um 15:35 hat Peter Maydell geschrieben:
> This set of patches fixes four reported bugs in vmdk's handling of
> potentially malicious image files:
> 
>  #3843: if cluster_sectors is 0x200000 we can overflow an 'int' and try
>         to g_malloc() 0xffffffff80000000
>  #4017: if cluster_sectors is 0 we will divide by zero and SIGFPE
>  #4029: we can overflow a 32*64 multiply; we catch it a bit later on
>         so there are no ill-effects, but for robustness it's better to
>         check before the multiply
>  #4571: we can read off the end of a block of memory when trying to
>         parse descriptors; worst case is that we read some junk from
>         the heap into BlockDriverState::auto_backing_file and
>         ::backing_file. I don't think this is an exploitable info
>         leak into the guest.
>  #4571: if the input file specifies no extents, we hit an assert
>         in vmdk_co_get_info() rather than rejecting the file
>         (mentioned in passing in the same issue as previous bug)
> 
> I think these all classify as "hardening bugs" rather than security
> issues, since they're just "self-denial-of-service" at worst.
> 
> Tested using qemu-iotests on the vmdk format.

Thanks, applied to the block branch.

It would have been nice to add new qemu-iotests cases that can catch
these bugs, maybe you still want to do that on top?

And just looking briefly at each of the places that are patched, it's
immediately clear to me that some more fixes are needed.  :-)

Kevin