qemu-img: fix division by zero in bench_cb() for zero-sized images

Commit Message

[e-mail] March 18, 2025, 10:19 a.m. UTC

From: Denis Rastyogin <[e-mail]>

This error was discovered by fuzzing qemu-img.

This commit fixes a division by zero error in the bench_cb() function
that occurs when using the bench command with a zero-sized image.

The issue arises because b->image_size can be zero, leading to a
division by zero in the modulo operation (b->offset %= b->image_size).
This patch adds a check for b->image_size == 0 and resets b->offset
to 0 in such cases, preventing the error.

Signed-off-by: Denis Rastyogin <[e-mail]>
---
 qemu-img.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

Comments

Kevin Wolf March 18, 2025, 12:03 p.m. UTC | #1

Am 18.03.2025 um 11:19 hat [e-mail] geschrieben:
> From: Denis Rastyogin <[e-mail]>
> 
> This error was discovered by fuzzing qemu-img.
> 
> This commit fixes a division by zero error in the bench_cb() function
> that occurs when using the bench command with a zero-sized image.
> 
> The issue arises because b->image_size can be zero, leading to a
> division by zero in the modulo operation (b->offset %= b->image_size).
> This patch adds a check for b->image_size == 0 and resets b->offset
> to 0 in such cases, preventing the error.
> 
> Signed-off-by: Denis Rastyogin <[e-mail]>

Thanks, applied to the block branch.

Kevin

Patch

diff --git a/qemu-img.c b/qemu-img.c
index 89c93c1eb5..2044c22a4c 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -4488,7 +4488,11 @@  static void bench_cb(void *opaque, int ret)
          */
         b->in_flight++;
         b->offset += b->step;
-        b->offset %= b->image_size;
+        if (b->image_size == 0) {
+            b->offset = 0;
+        } else {
+            b->offset %= b->image_size;
+        }
         if (b->write) {
             acb = blk_aio_pwritev(b->blk, offset, b->qiov, 0, bench_cb, b);
         } else {