parallels: fix integer overflow in header size calculation
parallels_open() caches bat_entry_off(s->bat_size) - a uint32_t - in a plain int before it feeds into s->header_size. Near the "Catalog too large" bound the value exceeds INT_MAX and overflows on assignment. Match the cached value's type to bat_entry_off()'s return type. Signed-off-by: Denis V. Lunev <den@openvz.org> CC: Thomas Huth <thuth@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com>
Denis V. Lunev committed
Jul 22, 2026 at 18:54 UTC
21a77a215809beafad1c4bfd12e691ec058eb6d0
1 file changed
+2
-1
block/parallels.c
+2
-1
@@ -1240,7 +1240,8 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags,
1240
{
1241
BDRVParallelsState *s = bs->opaque;
1242
ParallelsHeader ph;
1243
- int ret, size, i;
1243
+ int ret, i;
1244
+ uint32_t size;
1245
int64_t file_nb_sectors, sector;
1246
uint32_t data_start;
1247
bool need_check = false;