Re: [PATCH] block/vhdx-log: Improve sanity checks to avoid OOB accesses with bad images

[Kevin Wolf <kwolf@redhat.com>]

Am 11.11.2026 um 16:06 hat Thomas Huth geschrieben:
> The multiplication "hdr->descriptor_count * sizeof(VHDXLogDescriptor)" in
> vhdx_log_hdr_is_valid() can overflow on 32-bit systems, so this function
> could mark bad images as valid when the truncated result is smaller than
> hdr->entry_length. Switch to a division on the right hand side instead to
> avoid the overflow problems.
> 
> The second problem is in vhdx_log_read_desc(): desc_sectors is a 32-bit
> value, thus the multiplication "desc_sectors * VHDX_LOG_SECTOR_SIZE" is
> also done with 32 bit arithmetics, and the result is used as "size_t"
> parameter for qemu_try_blockalign(), i.e. the parameter here is also
> only 32 bits on 32-bit systems. Let's add a sanity check here to avoid
> the overflow problem that could lead to trouble later.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3860
> Signed-off-by: Thomas Huth <thuth@redhat.com>

Thanks, applied to the block branch.

Kevin