block/vmdk: prevent division by zero with zero cluster sectors

[PATCH] block/vmdk: prevent division by zero with zero cluster sectors

gerben@altlinux.org posted 1 patch 1 month, 1 week ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260817141456.59418-1-gerben@altlinux.org

Maintainers: Fam Zheng <fam@euphon.net>, Kevin Wolf <kwolf@redhat.com>, Hanna Reitz <hreitz@redhat.com>

block/vmdk.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

Expand all Fold all

[PATCH] block/vmdk: prevent division by zero with zero cluster sectors

Posted by gerben@altlinux.org 1 month, 1 week ago

From: Denis Rastyogin <gerben@altlinux.org>

A zero cluster_sectors value passes the existing upper-bound check
and later causes a division-by-zero in get_cluster_offset().

UBSan reports:

../block/vmdk.c:1608:30: runtime error: division by zero
    #0 0x5562d3b3b63b in get_cluster_offset ../block/vmdk.c:1608
    #1 0x5562d3db9aa7 in vmdk_co_block_status ../block/vmdk.c:1796
    #2 0x5562d3c48bb3 in bdrv_co_do_block_status ../block/io.c:2494
    #3 0x5562d3c55a3d in bdrv_co_common_block_status_above ../block/io.c:2672
    #4 0x5562d3c5630e in bdrv_co_block_status_above ../block/io.c:2752
    #5 0x5562d3ec5a3d in bdrv_co_block_status_above_entry block/block-gen.c:386
    #6 0x5562d40ab573 in coroutine_trampoline ../util/coroutine-ucontext.c:175

Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
---
 block/vmdk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/vmdk.c b/block/vmdk.c
index cd8b4ec7c8..7a7935b25a 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -537,7 +537,7 @@ static int vmdk_add_extent(BlockDriverState *bs,
     BDRVVmdkState *s = bs->opaque;
     int64_t nb_sectors;
 
-    if (cluster_sectors > 0x200000) {
+    if (cluster_sectors == 0 || cluster_sectors > 0x200000) {
         /* 0x200000 * 512Bytes = 1GB for one cluster is unrealistic */
         error_setg(errp, "Invalid granularity, image may be corrupt");
         return -EFBIG;
-- 
2.50.1