From 1633b8cd69483ed6c481aa596d3c760c09257c27 Mon Sep 17 00:00:00 2001 From: "Halil Oktay (oblivionsage)" Date: Tue, 10 Feb 2026 13:33:25 +0100 Subject: [PATCH] block/vmdk: fix OOB read in vmdk_read_extent() Bounds check for marker.size doesn't account for the 12-byte marker header, allowing zlib to read past the allocated buffer. Move the check inside the has_marker block and subtract the marker size. CVE: CVE-2026-2243 Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/86b5130fefbe476f3c0a85b9e136f9e3fd518689] Fixes: CVE-2026-2243 Reported-by: Halil Oktay (oblivionsage) Signed-off-by: Halil Oktay (oblivionsage) Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf (cherry picked from commit cfda94eddb6c9c49b66461c950b22845a46a75c9) Signed-off-by: Michael Tokarev (cherry picked from commit 86b5130fefbe476f3c0a85b9e136f9e3fd518689) Signed-off-by: Ashishkumar Parmar --- block/vmdk.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/block/vmdk.c b/block/vmdk.c index 89e89cd10..cd8b4ec7c 100644 --- a/block/vmdk.c +++ b/block/vmdk.c @@ -1951,10 +1951,10 @@ vmdk_read_extent(VmdkExtent *extent, int64_t cluster_offset, marker = (VmdkGrainMarker *)cluster_buf; compressed_data = marker->data; data_len = le32_to_cpu(marker->size); - } - if (!data_len || data_len > buf_bytes) { - ret = -EINVAL; - goto out; + if (!data_len || data_len > buf_bytes - sizeof(VmdkGrainMarker)) { + ret = -EINVAL; + goto out; + } } ret = uncompress(uncomp_buf, &buf_len, compressed_data, data_len); if (ret != Z_OK) {