dmg: refuse to open files with no chunks
The dmg block driver expects the disk image file to contain at least one chunk. Refuse to open such files. This ensures that dmg block driver state always has non-NULL s->sectors[] and related fields. Note that the previous commit fixed the only known way to trigger a crash. This patch is just for defense - let's avoid opening the file and having NULL pointers in dmg block driver state. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4021 Reported-by: Tristan Madani <tristan@talencesecurity.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-ID: <20260723144519.364701-3-stefanha@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Stefan Hajnoczi committed
Jul 23, 2026 at 10:45 UTC
ab7b872f0c38ee2a576b93cf37b9945f622d48fb
1 file changed
+6
block/dmg.c
+6
@@ -559,6 +559,12 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
559
goto fail;
560
}
561
562
+ /* There must be at least one chunk */
563
+ if (s->n_chunks == 0) {
564
+ ret = -EINVAL;
565
+ goto fail;
566
+ }
567
+
568
/* initialize zlib engine */
569
s->compressed_chunk = qemu_try_blockalign(bs->file->bs,
570
ds.max_compressed_size + 1);