Sayed Kaif 6882276e2d block: vhdx: reject overflowing region table entries ...

The region table overlap fix in RegionInfo::new computes each entry's
end offset as `file_offset + length`. Both values are taken verbatim
from the image, so a crafted or corrupt VHDX can set a file offset near
u64::MAX and make that addition wrap. A wrapped end offset compares as a
small value, which can slip a genuinely overlapping region past the
half-open interval check that #8483 added.

Use checked_add for the end offset and return a new RegionEntryOverflow
error when it wraps, so a malformed entry is rejected instead of being
folded into a valid-looking range. The computed end is now reused for
the region_entries map so the bound is only calculated once. Add a
regression test for a wrapping entry.

Signed-off-by: Sayed Kaif <metsw24@gmail.com>

2026-07-06 22:50:24 +00:00

..

src

block: vhdx: reject overflowing region table entries

2026-07-06 22:50:24 +00:00

Cargo.toml

block: vhdx: Use zerocopy for structs

2026-07-01 12:51:55 +00:00