[Qemu-devel] [PATCH] qcow2: Reject unrealistically large header extensions

[Kevin Wolf <kwolf@redhat.com>]

Image files that make qemu-img info read several gigabytes into the
unknown header extensions list are bad. Just fail opening the image
if an extension claims to be large.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qcow2.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/block/qcow2.c b/block/qcow2.c
index f68f0e1..077fe05 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -108,6 +108,11 @@ static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
 #ifdef DEBUG_EXT
         printf("ext.magic = 0x%x\n", ext.magic);
 #endif
+        if (ext.len > 65536) {
+            error_report("Header extension larger than 64k - this looks wrong");
+            return -ENOTSUP;
+        }
+
         switch (ext.magic) {
         case QCOW2_EXT_MAGIC_END:
             return 0;
-- 
1.7.6.5