[PATCH] block/vhdx-log: Improve sanity checks to avoid OOB accesses with bad images

[PATCH] block/vhdx-log: Improve sanity checks to avoid OOB accesses with bad images

[Thomas Huth]

The multiplication "hdr->descriptor_count * sizeof(VHDXLogDescriptor)" in
vhdx_log_hdr_is_valid() can overflow on 32-bit systems, so this function
could mark bad images as valid when the truncated result is smaller than
hdr->entry_length. Switch to a division on the right hand side instead to
avoid the overflow problems.

The second problem is in vhdx_log_read_desc(): desc_sectors is a 32-bit
value, thus the multiplication "desc_sectors * VHDX_LOG_SECTOR_SIZE" is
also done with 32 bit arithmetics, and the result is used as "size_t"
parameter for qemu_try_blockalign(), i.e. the parameter here is also
only 32 bits on 32-bit systems. Let's add a sanity check here to avoid
the overflow problem that could lead to trouble later.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3860
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 block/vhdx-log.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/block/vhdx-log.c b/block/vhdx-log.c
index 4385a2d4f62..5c20468e1e6 100644
--- a/block/vhdx-log.c
+++ b/block/vhdx-log.c
@@ -246,7 +246,7 @@ static bool vhdx_log_hdr_is_valid(VHDXLogEntries *log, VHDXLogEntryHeader *hdr,
         goto exit;
     }
 
-    if (hdr->descriptor_count * sizeof(VHDXLogDescriptor) > hdr->entry_length) {
+    if (hdr->descriptor_count > hdr->entry_length / sizeof(VHDXLogDescriptor)) {
         goto exit;
     }
 
@@ -360,6 +360,10 @@ vhdx_log_read_desc(BlockDriverState *bs, BDRVVHDXState *s, VHDXLogEntries *log,
     }
 
     desc_sectors = vhdx_compute_desc_sectors(hdr.descriptor_count);
+    if (desc_sectors > UINT32_MAX / VHDX_LOG_SECTOR_SIZE) {
+        ret = -EINVAL;
+        goto exit;
+    }
     desc_entries = qemu_try_blockalign(bs->file->bs,
                                        desc_sectors * VHDX_LOG_SECTOR_SIZE);
     if (desc_entries == NULL) {
-- 
2.56.0

Re: [PATCH] block/vhdx-log: Improve sanity checks to avoid OOB accesses with bad images

[Kevin Wolf]

Am 11.11.2026 um 16:06 hat Thomas Huth geschrieben:
> The multiplication "hdr->descriptor_count * sizeof(VHDXLogDescriptor)" in
> vhdx_log_hdr_is_valid() can overflow on 32-bit systems, so this function
> could mark bad images as valid when the truncated result is smaller than
> hdr->entry_length. Switch to a division on the right hand side instead to
> avoid the overflow problems.
> 
> The second problem is in vhdx_log_read_desc(): desc_sectors is a 32-bit
> value, thus the multiplication "desc_sectors * VHDX_LOG_SECTOR_SIZE" is
> also done with 32 bit arithmetics, and the result is used as "size_t"
> parameter for qemu_try_blockalign(), i.e. the parameter here is also
> only 32 bits on 32-bit systems. Let's add a sanity check here to avoid
> the overflow problem that could lead to trouble later.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3860
> Signed-off-by: Thomas Huth <thuth@redhat.com>

Thanks, applied to the block branch.

Kevin