Message ID | 20250318105924.258014-1-gerben@altlinux.org (mailing list archive) |
---|---|
State | New |
Headers | show |
Series | qcow2: fix null pointer dereference in crypto block | expand |
Am 18.03.2025 um 11:58 hat gerben@altlinux.org geschrieben: > From: Denis Rastyogin <gerben@altlinux.org> > > This error was discovered by fuzzing qemu-img. > > The qcow2_refresh_limits() is missing a check > for the s->crypto pointer, which can lead to > a null pointer dereference. This commit adds the necessary check. > > Reported-by: Leonid Reviakin <L.reviakin@fobos-nt.ru> > Signed-off-by: Denis Rastyogin <gerben@altlinux.org> Please provide more information how to trigger this. This is probably the wrong place to fix it. I think a qcow2 image that has bs->encrypted should always also have s->crypto, so we need to understand why this isn't the case here. Kevin
You can reproduce this issue by running ./qemu-img info segv. The segv file used for reproduction can be found here: https://github.com/Gerben100/reproduce_qemu-img_error
Am 18.03.2025 um 14:00 hat gerben@altlinux.org geschrieben: > You can reproduce this issue by running ./qemu-img info segv. > The segv file used for reproduction can be found here: > https://github.com/Gerben100/reproduce_qemu-img_error Thanks. Your patch makes sure that qemu-img doesn't crash any more, but we should catch the invalid image already while opening it. I'll send a different patch. Kevin
diff --git a/block/qcow2.c b/block/qcow2.c index dd6bcafbd8..55861a285a 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -1978,6 +1978,10 @@ static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp) if (bs->encrypted) { /* Encryption works on a sector granularity */ + if (!s->crypto) { + error_setg(errp, "Encryption context is missing"); + return; + } bs->bl.request_alignment = qcrypto_block_get_sector_size(s->crypto); } bs->bl.pwrite_zeroes_alignment = s->subcluster_size;