On 7/1/23 12:07, Alexander Ivanov wrote:
Initially data_end is set to the data_off image header field and must not be
should be truncated to 74 symbols
greater than the file size.
Signed-off-by: Alexander Ivanov <[email protected]>
---
block/parallels.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/block/parallels.c b/block/parallels.c
index 86bc3bfcb8..40a26908db 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -868,6 +868,11 @@ static int parallels_open(BlockDriverState *bs, QDict
*options, int flags,
and actual data. We can't avoid read-modify-write... */
s->header_size = size;
}
+ if (s->data_end > file_nb_sectors) {
+ error_setg(errp, "Invalid image: incorrect data_off field");
+ ret = -EINVAL;
+ goto fail;
+ }
ret = bdrv_pread(bs->file, 0, s->header_size, s->header, 0);
if (ret < 0) {
With comment line truncated to 74 chars:
Reviewed-by: Denis V. Lunev <[email protected]>
