On Fri, Aug 14, 2026 at 14:07:25 +0300, Sergey Zhidkih wrote: > 'virStorageFileGetEncryptionPayloadOffset' expects payloadOffset + 4 to > be in buffer bounds which isn't checked anywhere. > > For example malicious actor may provide LUKS header with just magic and > version like: '4c554b53 babe 0001'. This example successefully passes > 'virStorageFileHasEncryptionFormat' and leads to OOB read of 4 bytes. > > So the fix is to add bounds checks. > > Fixes: b7d44f450c06803df7df3ad380f7a5c97425c1e6 > Closes: https://gitlab.com/libvirt/libvirt/-/work_items/906 > > Signed-off-by: Sergey Zhidkih <[email protected]> > --- > src/storage_file/storage_file_probe.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-)
Reviewed-by: Peter Krempa <[email protected]> and pushed
