From 53a9ae08c2572198ce66f075d3742e97e82eaef4 Mon Sep 17 00:00:00 2001
From: Anatol Belski <anbelski@linux.microsoft.com>
Date: Mon, 1 Jun 2026 17:35:10 +0200
Subject: [PATCH] block: qcow: Reject backing file offset with zero size

A qcow2 header with non-zero backing_file_offset that points at a
zero length name is malformed. The parser would otherwise read an
empty path string and store it as a backing file. Reject it with a
dedicated error so the user gets a clear diagnostic.

Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
---
 block/src/formats/qcow/internal/header.rs | 5 +++++
 block/src/formats/qcow/internal/mod.rs    | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/block/src/formats/qcow/internal/header.rs b/block/src/formats/qcow/internal/header.rs
index ece9acd4a..4a16b8a00 100644
--- a/block/src/formats/qcow/internal/header.rs
+++ b/block/src/formats/qcow/internal/header.rs
@@ -336,6 +336,11 @@ impl QcowHeader {
                 header.backing_file_size,
             ));
         }
+        if header.backing_file_offset != 0 && header.backing_file_size == 0 {
+            return Err(Error::BackingFileOffsetWithoutSize(
+                header.backing_file_offset,
+            ));
+        }
         if header.backing_file_offset != 0 {
             let cluster_size = 1u64
                 .checked_shl(header.cluster_bits)
diff --git a/block/src/formats/qcow/internal/mod.rs b/block/src/formats/qcow/internal/mod.rs
index ab4e6776c..b3203d2f8 100644
--- a/block/src/formats/qcow/internal/mod.rs
+++ b/block/src/formats/qcow/internal/mod.rs
@@ -66,6 +66,8 @@ use crate::error::{BlockError, BlockErrorKind, BlockResult};
 pub enum Error {
     #[error("Backing file I/O error: {0}")]
     BackingFileIo(String /* path */, #[source] io::Error),
+    #[error("Backing file offset {0:#x} with zero size")]
+    BackingFileOffsetWithoutSize(u64),
     #[error("Backing file open error: {0}")]
     BackingFileOpen(String /* path */, #[source] Box<Error>),
     #[error(