storage_file: bound-check the qcow2v3 header-size read

qcow2GetExtensions() reads a 4-byte value at offset QCOW2v3_HDR_SIZE (100) for a
version-3 image, but the only upstream length guard (qcow2GetFeatures) requires
just buf_size >= 100. For a probed file of 100-102 bytes this reads up to 3 bytes
past the buffer. Require buf_size >= QCOW2v3_HDR_SIZE + 4 before the read, as the
other probe helpers already do for their offsets.

Signed-off-by: HE WEI（ギカク） <skyexpoc@gmail.com>

diff --git a/src/storage_file/storage_file_probe.c b/src/storage_file/storage_file_probe.c
index a1f4c25b3d3ba1ef784cc628739defe7b7efe527..cc5854d36034e9b616eaeb84b2c0fa0e14f00509 100644 (file)
--- a/src/storage_file/storage_file_probe.c
+++ b/src/storage_file/storage_file_probe.c
@@ -466,10 +466,14 @@ qcow2GetExtensions(virStorageSource *meta,
 
     g_clear_pointer(&meta->dataFileRaw, g_free);
 
-    if (version == 2)
+    if (version == 2) {
         extension_start = QCOW2_HDR_TOTAL_SIZE;
-    else
+    } else {
+        if (buf_size < QCOW2v3_HDR_SIZE + 4)
+            return -1;
+
         extension_start = virReadBufInt32BE(buf + QCOW2v3_HDR_SIZE);
+    }
 
     /*
      * QCow2 header extensions are stored directly after the header before