From: HE WEI（ギカク） <skyexpoc@gmail.com>
Date: Thu, 9 Jul 2026 10:47:43 +0000 (+0900)
Subject: storage_file: bound-check the qcow2v3 header-size read
X-Git-Tag: v12.6.0-rc1~36
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=305b6016ddba02eb0e6419fe293c44f7ba050d4d;p=thirdparty%2Flibvirt.git

storage_file: bound-check the qcow2v3 header-size read

qcow2GetExtensions() reads a 4-byte value at offset QCOW2v3_HDR_SIZE (100) for a
version-3 image, but the only upstream length guard (qcow2GetFeatures) requires
just buf_size >= 100. For a probed file of 100-102 bytes this reads up to 3 bytes
past the buffer. Require buf_size >= QCOW2v3_HDR_SIZE + 4 before the read, as the
other probe helpers already do for their offsets.

Signed-off-by: HE WEI（ギカク） <skyexpoc@gmail.com>
---

diff --git a/src/storage_file/storage_file_probe.c b/src/storage_file/storage_file_probe.c
index a1f4c25b3d..cc5854d360 100644
--- a/src/storage_file/storage_file_probe.c
+++ b/src/storage_file/storage_file_probe.c
@@ -466,10 +466,14 @@ qcow2GetExtensions(virStorageSource *meta,
 
     g_clear_pointer(&meta->dataFileRaw, g_free);
 
-    if (version == 2)
+    if (version == 2) {
         extension_start = QCOW2_HDR_TOTAL_SIZE;
-    else
+    } else {
+        if (buf_size < QCOW2v3_HDR_SIZE + 4)
+            return -1;
+
         extension_start = virReadBufInt32BE(buf + QCOW2v3_HDR_SIZE);
+    }
 
     /*
      * QCow2 header extensions are stored directly after the header before