Denis V. Lunev 4684bf187f parallels: bound the bitmap L1 table against the bitmap size ...

parallels_load_bitmap_data() derives the number of bytes to
deserialize from "bm_size - offset" without checking that the offset
is still inside the bitmap, and an offset past the end makes that
subtraction underflow.

The overflow which used to produce such an offset is fixed by
"dirty-bitmap: fix integer overflow in serialization coverage", but
both the cluster size and the L1 contents come from the image, so
refuse the table explicitly. The check cannot reject a valid table:
l1_size is DIV_ROUND_UP(bm_size, limit), so the largest offset the
loop reaches is (l1_size - 1) * limit, always below bm_size.

Fixes: baefd97700 ("parallels: support bitmap extension for read-only mode")
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Thomas Huth <thuth@redhat.com>
Signed-off-by: Denis V. Lunev <den@openvz.org>

2026-09-10 23:48:08 +02:00

..

export

block/export/fuse: fix regression with O_TRUNC when export is not growable

2026-08-03 10:42:29 +02:00

monitor

build-sys: make HMP source files conditional on have_hmp

2026-08-29 12:07:45 +04:00

accounting.c

block/qapi: take stats->lock when reading BlockAcctStats for query-blockstats

2026-08-03 10:42:29 +02:00

aio_task.c

block: rename block/aio.h to qemu/aio.h

2025-12-27 10:11:12 +01:00

amend.c

block: Mark BlockDriver callbacks for amend job GRAPH_RDLOCK

2023-05-10 14:16:54 +02:00

backup.c

block: add bdrv_graph_wrlock_drained() convenience wrapper

2025-07-14 15:40:58 +02:00

blkdebug.c

blkdebug: Add 'delay-ns' option

2026-05-19 17:25:48 +02:00

blkio.c

block/blkio: fix compiler false-positive warning

2026-07-27 15:51:03 +04:00

blklogwrites.c

bswap: Include missing 'qemu/bswap.h' header

2026-01-22 10:48:45 +01:00

blkreplay.c

blkreplay: Run BH in coroutine’s AioContext

2025-11-18 18:01:55 +01:00

blkverify.c

block: add bdrv_graph_wrlock_drained() convenience wrapper

2025-07-14 15:40:58 +02:00

block-backend.c

block: Add flags parameter to blk_*_pdiscard()

2026-05-19 17:25:48 +02:00

block-copy.c

include: Rename sysemu/ -> system/

2024-12-20 17:44:56 +01:00

block-gen.h

block-coroutine-wrapper.py: support also basic return types

2022-12-15 16:07:43 +01:00

block-ram-registrar.c

include: Rename sysemu/ -> system/

2024-12-20 17:44:56 +01:00

bochs.c

block: replace TABs with space

2025-11-11 22:06:09 +01:00

cloop.c

block/cloop: fix integer overflow in total_sectors calculation

2026-08-03 10:42:29 +02:00

commit.c

block: add missing coroutine annotation

2026-07-27 15:51:03 +04:00

copy-before-write.c

block: Expand block status mode from bool to flags

2025-05-14 15:33:34 -05:00

copy-before-write.h

blockdev-backup: Add error handling option for copy-before-write jobs

2025-05-12 18:19:31 +03:00

copy-on-read.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

copy-on-read.h

block: Mark bdrv_(un)freeze_backing_chain() and callers GRAPH_RDLOCK

2023-11-07 19:14:19 +01:00

coroutines.h

block: Expand block status mode from bool to flags

2025-05-14 15:33:34 -05:00

create.c

qemu/compiler: Absorb 'clang-tsa.h'

2025-03-06 14:21:25 +01:00

crypto.c

error: Consistently name Error * objects err, and not errp

2026-01-07 11:26:57 +01:00

crypto.h

block: Support detached LUKS header creation using qemu-img

2024-02-09 12:50:37 +00:00

curl.c

block/curl: set User-Agent header

2026-07-23 18:03:24 +03:00

dirty-bitmap.c

dirty-bitmap: fix integer overflow in serialization coverage

2026-08-17 18:32:44 +03:00

dmg-bz2.c

Include qemu-common.h exactly where needed

2019-06-12 13:20:20 +02:00

dmg-lzfse.c

block/dmg: Ignore C99 prototype declaration mismatch from <lzfse.h>

2023-03-30 15:03:36 +02:00

dmg.c

dmg: reject inconsistent UDRW chunk sector count and length (CVE-2026-65928)

2026-08-03 10:42:29 +02:00

dmg.h

block/dmg: Declare a type definition for DMG uncompress function

2023-04-24 13:53:44 -04:00

file-posix.c

file-posix: fix zone write granularity assignment for zoned block devices

2026-09-01 14:38:03 -04:00

file-win32.c

block/file-win32: Improve an error message

2026-01-08 07:50:32 +01:00

filter-compress.c

block: Take graph lock for most of .bdrv_open

2023-11-08 17:56:18 +01:00

graph-lock.c

block/graph-lock: fix missed wakeup in bdrv_graph_co_rdunlock()

2026-05-19 17:25:48 +02:00

io_uring.c

io-uring: Resubmit tails of short writes

2026-03-24 19:55:09 +01:00

io.c

block/io: Use QEMU_LOCK_GUARD to simplify mutex handling

2026-06-12 17:56:30 +03:00

iscsi-opts.c

modules: add block module annotations

2021-07-09 18:20:27 +02:00

iscsi.c

iscsi: Create AIO BH in original AioContext

2025-11-18 18:01:57 +01:00

linux-aio.c

block/linux-aio: bound ioq_submit() recursion depth

2026-05-25 11:17:23 -04:00

meson.build

Remove the deprecated glusterfs block driver

2026-05-19 17:25:48 +02:00

mirror.c

block: Add flags parameter to blk_*_pdiscard()

2026-05-19 17:25:48 +02:00

nbd.c

block/nbd: clear reply.cookie under receive_mutex

2026-09-02 11:39:46 +03:00

nfs.c

block/nfs: add support for libnfs v6

2026-03-10 14:33:55 +01:00

null.c

null-aio: Run CB in original AioContext

2025-11-18 18:01:57 +01:00

nvme.c

Revert "nvme: Fix coroutine waking"

2025-12-15 09:50:41 -05:00

parallels-ext.c

parallels: bound the bitmap L1 table against the bitmap size

2026-09-10 23:48:08 +02:00

parallels.c

parallels: validate BAT capacity against advertised disk size

2026-07-28 16:55:00 +02:00

parallels.h

block: Protect bs->file with graph_lock

2023-11-08 17:56:18 +01:00

preallocate.c

block: Protect bs->file with graph_lock

2023-11-08 17:56:18 +01:00

progress_meter.c

coroutine: Clean up superfluous inclusion of qemu/lockable.h

2023-01-19 10:18:28 +01:00

qapi-system.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

qapi.c

block/qapi: take stats->lock when reading BlockAcctStats for query-blockstats

2026-08-03 10:42:29 +02:00

qcow2-bitmap.c

block/monitor: allow dropping a bitmap never stored on disk

2026-08-17 18:32:44 +03:00

qcow2-cache.c

qcow2: Mark qcow2_signal_corruption() and callers GRAPH_RDLOCK

2023-10-12 16:31:33 +02:00

qcow2-cluster.c

qcow2: Fix data loss on zero write with detect-zeroes=unmap

2026-06-08 17:00:46 +02:00

qcow2-refcount.c

qcow2: put discards in discard queue when discard-no-unref is enabled

2025-11-11 22:06:09 +01:00

qcow2-snapshot.c

qcow2: remove invalid qcow2_check_refcounts calls

2026-07-27 15:51:03 +04:00

qcow2-threads.c

thread-pool: avoid passing the pool parameter every time

2023-04-25 13:17:28 +02:00

qcow2.c

qcow2: do not try to clear the dirty bit on a read-only node

2026-08-03 10:42:29 +02:00

qcow2.h

qcow2: Fix data loss on zero write with detect-zeroes=unmap

2026-06-08 17:00:46 +02:00

qcow.c

block: Allow drivers to control protocol prefix at creation

2025-11-11 22:06:09 +01:00

qed-check.c

qed: mark more functions as coroutine_fns and GRAPH_RDLOCK

2023-06-28 09:46:20 +02:00

qed-cluster.c

qed: protect table cache with CoMutex

2017-07-17 11:34:11 +08:00

qed-l2-cache.c

osdep: Move memalign-related functions to their own header

2022-03-07 13:16:49 +00:00

qed-table.c

block: use bdrv_co_debug_event in coroutine context

2023-06-28 09:46:34 +02:00

qed.c

qed: Don't try to flush during incoming migration

2026-06-10 12:12:48 +02:00

qed.h

block: Protect bs->file with graph_lock

2023-11-08 17:56:18 +01:00

quorum.c

block: add bdrv_graph_wrlock_drained() convenience wrapper

2025-07-14 15:40:58 +02:00

raw-format.c

block: Allow drivers to control protocol prefix at creation

2025-11-11 22:06:09 +01:00

rbd.c

rbd: Run co BH CB in the coroutine’s AioContext

2025-11-18 18:01:50 +01:00

replication.c

block: mark bdrv_reopen_queue() and bdrv_reopen_multiple() as GRAPH_UNLOCKED

2025-07-14 15:42:05 +02:00

reqlist.c

block/reqlist: allow adding overlapping requests

2024-09-30 10:53:18 +03:00

snapshot-access.c

block: Expand block status mode from bool to flags

2025-05-14 15:33:34 -05:00

snapshot.c

block: add bdrv_graph_wrlock_drained() convenience wrapper

2025-07-14 15:40:58 +02:00

ssh.c

ssh: Run restart_coroutine in current AioContext

2025-11-18 18:01:55 +01:00

stream.c

block/stream: mark stream_prepare() as GRAPH_UNLOCKED

2025-07-14 15:42:04 +02:00

throttle-groups.c

block/throttle-groups: fix throttle properties typename

2026-09-08 19:06:36 +04:00

throttle.c

block: Take graph lock for most of .bdrv_open

2023-11-08 17:56:18 +01:00

trace-events

io-uring: Resubmit tails of short writes

2026-03-24 19:55:09 +01:00

trace.h

trace: switch position of headers to what Meson requires

2020-08-21 06:18:24 -04:00

vdi.c

block: Allow drivers to control protocol prefix at creation

2025-11-11 22:06:09 +01:00

vhdx-endian.c

Include qemu-common.h exactly where needed

2019-06-12 13:20:20 +02:00

vhdx-log.c

vhdx: Take locks for accessing bs->file

2023-11-08 17:56:18 +01:00

vhdx.c

block: Allow drivers to control protocol prefix at creation

2025-11-11 22:06:09 +01:00

vhdx.h

vhdx: Take locks for accessing bs->file

2023-11-08 17:56:18 +01:00

vmdk.c

block/vmdk: fix OOB read in vmdk_read_extent()

2026-03-03 14:45:01 +01:00

vpc.c

block: Allow drivers to control protocol prefix at creation

2025-11-11 22:06:09 +01:00

vvfat.c

Fix const qualifier build errors with recent glibc

2025-12-09 21:00:15 +01:00

win32-aio.c

block: rename block/aio.h to qemu/aio.h

2025-12-27 10:11:12 +01:00

write-threshold.c

block: remove AioContext locking

2023-12-21 22:49:27 +01:00