Commit f659157103 for qemu.org

commit f659157103de6f335d83d3770e383a52818399cb
Author: Stefan Hajnoczi <stefanha@redhat.com>
Date:   Tue Oct 13 15:37:08 2026 -0400

    dmg: avoid out-of-bounds memory load in dmg_read_mish_block()

    dmg_read_mish_block() loads from memory beyond the end of the buffer
    when count is less than 4.

    There is no known security impact here because dmg_read_mish_block()
    returns almost immediately without any opportunity to gain control of
    execution or cause other damage. A crash will not happen because it's a
    32-bit load from a memory address that was just heap allocated. The
    address will be properly aligned and will not span a page of memory.

    Reported-by: router0mail <https://gitlab.com/router0mail>
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    Reviewed-by: Eric Blake <eblake@redhat.com>
    Message-id: 20261013193710.1311621-1-stefanha@redhat.com
    Fixes: 7aee37b93a4f ("block/dmg: process a buffer instead of reading ints")
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4569
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

diff --git a/block/dmg.c b/block/dmg.c
index 5d7d3b8901..412d4bfc35 100644
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -226,9 +226,13 @@ static int dmg_read_mish_block(BDRVDMGState *s, DmgHeaderState *ds,
     uint64_t in_offset = ds->data_fork_offset;
     uint64_t out_offset;

+    if (count < 244) {
+        return 0; /* too small, skip silently */
+    }
+
     type = buff_read_uint32(buffer, offset);
-    /* skip data that is not a valid MISH block (invalid magic or too small) */
-    if (type != 0x6d697368 || count < 244) {
+    /* skip data that is not a valid MISH block (invalid magic) */
+    if (type != 0x6d697368) {
         /* assume success for now */
         return 0;
     }