Commit 43d614ab3a for qemu.org

commit 43d614ab3a2dfbbe8549b4410aef5ff0b8b0c661
Author: Peter Maydell <peter.maydell@linaro.org>
Date:   Tue Nov 3 14:35:16 2026 +0000

    block/vmdk: Avoid overflowing multiplication in vmdk_open_vmdk4()

    In vmdk_open_vmdk4() we set the uint32_t l1_entry_sectors with:
        l1_entry_sectors = le32_to_cpu(header.num_gtes_per_gt)
                            * le64_to_cpu(header.granularity);

    We have checked that num_gtes_per_gt is at most 512, but the
    header.granularity has not been checked at this point, and so the
    multiply can overflow the 32-bit variable.  This overflow is harmless
    beacuse we're about to call vmdk_add_extent(), which will fail if the
    header.granularity (cluster_sectors) is more than 0x20_0000, but it's
    a potential trap for the future if code that relies on the
    l1_entry_sectors value gets added between where we set it and where
    we make that check.

    Check for overlarge granularity at the point of multiplication so
    it's clear we can't overflow.

    Cc: qemu-stable@nongnu.org
    Reported-by: Tristan <https://gitlab.com/TristanInSec>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4029
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
    Message-ID: <20261103143516.2182626-6-peter.maydell@linaro.org>
    Reviewed-by: Kevin Wolf <kwolf@redhat.com>
    Signed-off-by: Kevin Wolf <kwolf@redhat.com>

diff --git a/block/vmdk.c b/block/vmdk.c
index d7e23ae809..a9bd8a4245 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -1052,7 +1052,10 @@ vmdk_open_vmdk4(BlockDriverState *bs, BdrvChild *file, int flags,
         error_setg(errp, "L2 table size too big");
         return -EINVAL;
     }
-
+    if (le64_to_cpu(header.granularity) > 0x200000) {
+        error_setg(errp, "Invalid granularity, image may be corrupt");
+        return -EFBIG;
+    }
     l1_entry_sectors = le32_to_cpu(header.num_gtes_per_gt)
                         * le64_to_cpu(header.granularity);
     if (l1_entry_sectors == 0) {