Initially data_end is set to the data_off image header field and must not be greater than the file size.
Signed-off-by: Alexander Ivanov <[email protected]> --- block/parallels.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/block/parallels.c b/block/parallels.c index 86bc3bfcb8..40a26908db 100644 --- a/block/parallels.c +++ b/block/parallels.c @@ -868,6 +868,11 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags, and actual data. We can't avoid read-modify-write... */ s->header_size = size; } + if (s->data_end > file_nb_sectors) { + error_setg(errp, "Invalid image: incorrect data_off field"); + ret = -EINVAL; + goto fail; + } ret = bdrv_pread(bs->file, 0, s->header_size, s->header, 0); if (ret < 0) { -- 2.34.1
