Commit 09153b7e5f for qemu.org

commit 09153b7e5f8f90bda4c8d6a2ac39bedc9c6ba373
Author: Peter Maydell <peter.maydell@linaro.org>
Date:   Tue Nov 3 14:35:15 2026 +0000

    block/vmdk: Reject a zero cluster_sectors parameter

    In vmdk_add_extent() we reject image files with an excessively large
    cluster_sectors parameter, but have no lower bound.  In particular,
    if the cluster_sectors is 0 then we will set l1_entry_sectors also to
    0, and later crash with a SIGFPE for division by zero.

    Reject a zero cluster_sectors value, unless this is a flat extent (in
    which case cluster_sectors isn't relevant and the callsite always
    passes us zero).

    The worst case here is a self-denial-of-service with a QEMU crash,
    so this is a hardening bug.

    Cc: qemu-stable@nongnu.org
    Fixes: b3976d3c8b89 ("VMDK: introduce VmdkExtent")
    Reported-by: Tristan <https://gitlab.com/TristanInSec>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4017
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
    Message-ID: <20261103143516.2182626-5-peter.maydell@linaro.org>
    Reviewed-by: Kevin Wolf <kwolf@redhat.com>
    Signed-off-by: Kevin Wolf <kwolf@redhat.com>

diff --git a/block/vmdk.c b/block/vmdk.c
index bd18d32085..d7e23ae809 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -552,6 +552,11 @@ static int vmdk_add_extent(BlockDriverState *bs,
     BDRVVmdkState *s = bs->opaque;
     int64_t nb_sectors;

+    if (!flat && cluster_sectors == 0) {
+        error_setg(errp, "Invalid zero granularity, image may be corrupt");
+        return -EINVAL;
+    }
+
     if (cluster_sectors > 0x200000) {
         /* 0x200000 * 512Bytes = 1GB for one cluster is unrealistic */
         error_setg(errp, "Invalid granularity, image may be corrupt");