@samitouri / QOSamiQemu / commits / 0c43f801c0

dmg: fix out-of-bounds load in search_chunk() (CVE-2026-65929)

The binary search in search_chunk() uses s->n_chunks as the (inclusive) upper bound. Chunk indices are in the right-open interval [0, s->n_chunks) so it is wrong to search all the way up to s->n_chunks rather than s->n_chunks - 1. The worst case security scenario I can see is convincing a victim to hotplug a malicious DMG file to a running guest, potentially causing QEMU to crash when loading from memory beyond the end of s->sectors[] or s->sectorscounts[]. This could be a denial of service. Fixes: CVE-2026-65929 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3844 Reported-by: boy juju <agx1657748706@gmail.com> Reported-by: Tristan Madani <tristan@talencesecurity.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-ID: <20260723144519.364701-2-stefanha@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>

Stefan Hajnoczi committed Jul 23, 2026 at 10:45 UTC 0c43f801c0d7a31ef05bc22914cca0b0e28210a8

1 file changed +4 -1

block/dmg.c

+4 -1

@@ -609,7 +609,10 @@ static inline int is_sector_in_chunk(BDRVDMGState *s,

609 static inline uint32_t search_chunk(BDRVDMGState *s, uint64_t sector_num)

610 {

611 /* binary search */

612 - uint32_t chunk1 = 0, chunk2 = s->n_chunks, chunk3;

612 + uint32_t chunk1 = 0, chunk2 = s->n_chunks - 1, chunk3;

613 + if (s->n_chunks == 0) {

614 + goto err; /* should never happen */

615 + }

616 while (chunk1 <= chunk2) {

617 chunk3 = (chunk1 + chunk2) / 2;

618 if (s->sectors[chunk3] > sector_num) {