Thanks to visit codestin.com
Credit goes to github.com

Skip to content

block: vhdx: fix region table overlap detection - #8445

Closed
metsw24-max wants to merge 1 commit into
cloud-hypervisor:mainfrom
metsw24-max:vhdx-region-overlap
Closed

metsw24-max wants to merge 1 commit into
cloud-hypervisor:mainfrom
metsw24-max:vhdx-region-overlap

Conversation

@metsw24-max

@metsw24-max metsw24-max commented Jun 22, 2026

Copy link
Copy Markdown
Contributor

VHDX region table entries declare a file offset and length, and RegionInfo::new is meant to reject a table whose entries overlap. The check was inverted though: !((start >= other_start) || (end <= other_end)) only fires when a new entry strictly contains an already seen one, so the common case of a partial overlap between two entries passes validation. The offsets come straight from the region table in the image, so a crafted or corrupt VHDX can present overlapping BAT and metadata regions and still be opened.

The replacement uses the standard interval test start < other_end && end > other_start. The end offset was also computed with an unchecked start + length, which can wrap on a hostile offset/length near u64::MAX and hide an overlap; it now uses checked_add and reports a RegionEntryOverflow error rather than silently saturating. Behaviour for well formed images is unchanged, and there is a regression test that builds a two entry table with a partial overlap and confirms it is rejected.

@metsw24-max
metsw24-max requested a review from a team as a code owner June 22, 2026 09:55
@phip1611

Copy link
Copy Markdown
Member

@weltling could you please take a look?

@rbradford rbradford left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@weltling weltling left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The code fix LGTM. The clippy fix should be trivial.

Thanks

@metsw24-max
metsw24-max force-pushed the vhdx-region-overlap branch from eec7e07 to 9a4fe45 Compare June 23, 2026 07:05
@metsw24-max

Copy link
Copy Markdown
Contributor Author

Sorted. The clippy failure was the test's unwrap_err() requiring RegionInfo: Debug; switched it to match on the Result directly so nothing extra needs deriving. Pushed.

@sboeuf sboeuf left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you please update your commit by including a commit message explaining what the patch is doing?
The title is slightly misleading since the check was already existing, it's more that you're trying to also catch the case where the addition overflow would prevent the overlap to be detected.

offset += size_of::<RegionTableEntry>();
let start = entry.file_offset;
let end = start + entry.length as u64;
let end = start.saturating_add(entry.length as u64);

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure that's the right approach here. IIUC, by using saturating_add() you end up always producing a valid u64, which avoids overflowing. This is hiding the fact that the addition didn't go well.
In such case, we should report the error, and that's why using something like checked_add() might help.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed, saturating just papers over the bad entry. Switched to checked_add so a wrapping start + length now returns a RegionEntryOverflow error instead of being clamped to a valid-looking u64.

@phip1611

phip1611 commented Jun 23, 2026

Copy link
Copy Markdown
Member

Could you please update your commit by including a commit message explaining what the patch is doing?

FYI: @metsw24-max our commit style can be found here: https://github.com/cloud-hypervisor/cloud-hypervisor/blob/main/CONTRIBUTING.md#patch-format--git-commit-hygiene

TL;DR: Explain why you change something in a way that is helpful for reviewers

RegionInfo::new walks the region table and is meant to reject any
two entries whose [file_offset, file_offset + length) ranges
overlap. Two issues let an overlapping table pass validation.

The overlap test was inverted: `!((start >= other_start) ||
(end <= other_end))` only fires when a new entry fully contains an
existing one, so partial and contained overlaps were accepted.
Replace it with the usual interval test
`start < other_end && end > other_start`.

The end offset was also computed with an unchecked `start + length`,
which wraps on an entry whose offset and length sum past u64::MAX.
A wrapped end yields a bogus range that hides the overlap, so use
checked_add and report a RegionEntryOverflow error when it wraps.

The offsets come straight from the on-disk table, so a corrupt or
crafted image could otherwise present overlapping BAT and metadata
regions and still be opened. Add a regression test covering a
two-entry table with a partial overlap.

Signed-off-by: Sayed Kaif <[email protected]>
@metsw24-max
metsw24-max force-pushed the vhdx-region-overlap branch from 9a4fe45 to 4164afb Compare June 23, 2026 16:57
@metsw24-max metsw24-max changed the title block: vhdx: reject overlapping region table entries block: vhdx: fix region table overlap detection Jun 23, 2026
@metsw24-max

Copy link
Copy Markdown
Contributor Author

Reworked the commit in the repo's format with a body that explains the why: the overlap test was inverted so partial overlaps slipped through, and the end offset used an unchecked add that could wrap and mask one. Retitled to "fix region table overlap detection" since, as you noted, the check itself already existed. The overflow path now uses checked_add per the inline note.

@rbradford

Copy link
Copy Markdown
Member

@metsw24-max Needs a rebase.

@rbradford

Copy link
Copy Markdown
Member

This was already merged as #8483 - but it's probably worth creating a new PR with with checked_add behaviour?

@metsw24-max

Copy link
Copy Markdown
Contributor Author

Makes sense, #8483 covers the overlap check. I've opened #8505 with just the checked_add overflow path on top of it, plus a regression test for a wrapping entry. Thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants