From: HE WEI（ギカク） <skyexpoc@gmail.com>
Date: Thu, 9 Jul 2026 10:35:22 +0000 (+0900)
Subject: qemu: saveimage: validate cookieOffset and NUL-terminate XML buffer
X-Git-Tag: v12.6.0-rc1~40
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7d67076dfe5359f24cd73034d21205ed24e8cd90;p=thirdparty%2Flibvirt.git

qemu: saveimage: validate cookieOffset and NUL-terminate XML buffer

qemuSaveImageReadHeader() computed cookie_len = data_len - xml_len in size_t
with no check that cookieOffset <= data_len; a crafted header with
cookieOffset > data_len underflows cookie_len to ~SIZE_MAX and g_new0() aborts
the daemon. The XML buffer was also allocated to exactly xml_len with no NUL
terminator, then parsed as a C string, allowing a heap over-read for a
non-NUL-terminated payload. Reject cookieOffset > data_len and allocate one
extra (zeroed) byte for the XML terminator.

Signed-off-by: HE WEI（ギカク） <skyexpoc@gmail.com>
---

diff --git a/src/qemu/qemu_saveimage.c b/src/qemu/qemu_saveimage.c
index 64fbcd5f51..d1a2bd8220 100644
--- a/src/qemu/qemu_saveimage.c
+++ b/src/qemu/qemu_saveimage.c
@@ -280,6 +280,12 @@ qemuSaveImageReadHeader(int fd, virQEMUSaveData **ret_data)
         return -1;
     }
 
+    if (header->cookieOffset > header->data_len) {
+        virReportError(VIR_ERR_OPERATION_FAILED, "%s",
+                       _("invalid save image header: cookie offset exceeds data length"));
+        return -1;
+    }
+
     if (header->cookieOffset)
         xml_len = header->cookieOffset;
     else
@@ -287,7 +293,7 @@ qemuSaveImageReadHeader(int fd, virQEMUSaveData **ret_data)
 
     cookie_len = header->data_len - xml_len;
 
-    data->xml = g_new0(char, xml_len);
+    data->xml = g_new0(char, xml_len + 1);
 
     if (saferead(fd, data->xml, xml_len) != xml_len) {
         virReportError(VIR_ERR_OPERATION_FAILED,