From 7da9623cc078229caf07c290e16401ccdb9408d2 Mon Sep 17 00:00:00 2001 From: Thomas Huth Date: Tue, 12 Oct 2021 10:27:02 +0200 Subject: [PATCH] block/vpc: Add a sanity check that fixed-size images have the right type The code in vpc.c uses BDRVVPCState->footer.type in various places to decide whether the image is a fixed-size (VHD_FIXED) or a dynamic (VHD_DYNAMIC) image. However, we never check that this field really contains VHD_FIXED if we detected a fixed size image in vpc_open(), so a wrong value here could cause quite some trouble during runtime. Suggested-by: Kevin Wolf Signed-off-by: Thomas Huth Message-Id: <20211012082702.792259-1-thuth@redhat.com> Signed-off-by: Hanna Reitz --- block/vpc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/block/vpc.c b/block/vpc.c index 1b4c7333af..297a26262a 100644 --- a/block/vpc.c +++ b/block/vpc.c @@ -276,7 +276,8 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags, if (ret < 0) { goto fail; } - if (strncmp(footer->creator, "conectix", 8)) { + if (strncmp(footer->creator, "conectix", 8) || + be32_to_cpu(footer->type) != VHD_FIXED) { error_setg(errp, "invalid VPC image"); ret = -EINVAL; goto fail;