Commit 53c06d5239 for qemu.org

commit 53c06d5239b4a4cc21686710bce478207dfbaa6e
Author: Peter Maydell <peter.maydell@linaro.org>
Date:   Tue Nov 3 14:35:14 2026 +0000

    block/vmdk: Use larger types for byte counts in vmdk_read_extent()

    In vmdk_read_extent() we use 'int' for cluster_bytes and buf_bytes.
    However, cluster_bytes is extent->cluster_sectors * 512 and buf_bytes
    is cluster_bytes * 2.  The maximum value for extent->cluster_sectors
    (enforced in vmdk_add_extent()) is 0x20_0000, and so the worst case
    for buf_bytes is 0x8000_0000, which overflows a signed int.

    Make the variable types here int64_t, which matches the type used by
    bdrv_co_pread()'s bytes argument and by extent->cluster_sectors.

    The worst case thing that a malicious VMDK image could do is cause us
    to try to g_malloc() 0xffffffff80000000, which will cause QEMU to
    abort(), so this is a self-denial-of-service only, and so a hardening
    bug rather than a security issue.

    Cc: qemu-stable@nongnu.org
    Fixes: 2b2c8c5dec6ba ("VMDK: read/write compressed extent")
    Reported-by: boy juju <agx1657748706@gmail.com>
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3843
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
    Message-ID: <20261103143516.2182626-4-peter.maydell@linaro.org>
    Reviewed-by: Kevin Wolf <kwolf@redhat.com>
    Signed-off-by: Kevin Wolf <kwolf@redhat.com>

diff --git a/block/vmdk.c b/block/vmdk.c
index 6e4e0423dc..bd18d32085 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -1940,7 +1940,7 @@ vmdk_read_extent(VmdkExtent *extent, int64_t cluster_offset,
                  int64_t offset_in_cluster, QEMUIOVector *qiov, int bytes)
 {
     int ret;
-    int cluster_bytes, buf_bytes;
+    int64_t cluster_bytes, buf_bytes;
     uint8_t *cluster_buf, *compressed_data;
     uint8_t *uncomp_buf;
     uint32_t data_len;