From 39e9376f5bac6d932cd1aa3a9fea57d6a5a32ad8 Mon Sep 17 00:00:00 2001 From: Anatol Belski Date: Mon, 1 Jun 2026 16:25:32 +0200 Subject: [PATCH] block: qcow: Reject backing file size with zero offset A qcow2 header with backing_file_offset == 0 indicates the image has no backing file, so any non-zero backing_file_size is malformed. Qemu silently ignores the size in this case, which hides image corruption. Reject it explicitly with a dedicated error so the user gets a clear diagnostic. Signed-off-by: Anatol Belski --- block/src/formats/qcow/internal/header.rs | 5 +++++ block/src/formats/qcow/internal/mod.rs | 2 ++ 2 files changed, 7 insertions(+) diff --git a/block/src/formats/qcow/internal/header.rs b/block/src/formats/qcow/internal/header.rs index 1989f25e3..ece9acd4a 100644 --- a/block/src/formats/qcow/internal/header.rs +++ b/block/src/formats/qcow/internal/header.rs @@ -331,6 +331,11 @@ impl QcowHeader { if header.backing_file_size > MAX_BACKING_FILE_SIZE { return Err(Error::BackingFileTooLong(header.backing_file_size as usize)); } + if header.backing_file_offset == 0 && header.backing_file_size != 0 { + return Err(Error::BackingFileSizeWithoutOffset( + header.backing_file_size, + )); + } if header.backing_file_offset != 0 { let cluster_size = 1u64 .checked_shl(header.cluster_bits) diff --git a/block/src/formats/qcow/internal/mod.rs b/block/src/formats/qcow/internal/mod.rs index 8e436d0ea..ab4e6776c 100644 --- a/block/src/formats/qcow/internal/mod.rs +++ b/block/src/formats/qcow/internal/mod.rs @@ -74,6 +74,8 @@ pub enum Error { BackingFileOutsideFirstCluster(u64, u32, u64), #[error("Backing file name at offset {0:#x} length {1:#x} overlaps header of size {2:#x}")] BackingFileOverlapsHeader(u64, u32, u32), + #[error("Backing file size {0:#x} with zero offset")] + BackingFileSizeWithoutOffset(u32), #[error("Backing file support is disabled")] BackingFilesDisabled, #[error("Backing file name is too long: {0} bytes over")]