From 09eb64f9e354f9af23a5c8b3b8021eb5969fc68a Mon Sep 17 00:00:00 2001 From: Alexander Ivanov Date: Tue, 18 Jul 2023 12:44:25 +0200 Subject: [PATCH] parallels: Check if data_end greater than the file size Initially data_end is set to the data_off image header field and must not be greater than the file size. Signed-off-by: Alexander Ivanov Reviewed-by: Denis V. Lunev Signed-off-by: Denis V. Lunev --- block/parallels.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/block/parallels.c b/block/parallels.c index 3c0dca3dbf..6a3d41373a 100644 --- a/block/parallels.c +++ b/block/parallels.c @@ -874,6 +874,11 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags, */ s->header_size = size; } + if (s->data_end > file_nb_sectors) { + error_setg(errp, "Invalid image: incorrect data_off field"); + ret = -EINVAL; + goto fail; + } ret = bdrv_pread(bs->file, 0, s->header_size, s->header, 0); if (ret < 0) { -- 2.11.0