block: fix VHDX region table overlap detection - #8483
Merged
likebreath merged 1 commit intoJun 29, 2026
Merged
Conversation
The region table overlap check in RegionInfo::new only rejected a new region that strictly engulfed an existing one. Identical, fully contained, and partially overlapping regions passed undetected, so a malformed VHDX with overlapping region entries was wrongly accepted. Per [MS-VHDX] all region objects MUST be non-overlapping, so such an image should be rejected. Replace the faulty predicate with a correct half-open interval overlap test, extracted into a small pure helper (ranges_overlap). Add a unit test for the predicate and an integration test that feeds a crafted region table with two overlapping entries through the real RegionInfo::new, confirming it is now rejected with RegionOverlap. Related to cloud-hypervisor#8009 (broader VHDX overlap validation). Signed-off-by: Henry Hrvoje Tonkovac <[email protected]> Assisted-by: Claude:Opus-4.8
likebreath
approved these changes
Jun 29, 2026
metsw24-max
added a commit
to metsw24-max/cloud-hypervisor
that referenced
this pull request
Jul 3, 2026
The region table overlap fix in RegionInfo::new computes each entry's end offset as `file_offset + length`. Both values are taken verbatim from the image, so a crafted or corrupt VHDX can set a file offset near u64::MAX and make that addition wrap. A wrapped end offset compares as a small value, which can slip a genuinely overlapping region past the half-open interval check that cloud-hypervisor#8483 added. Use checked_add for the end offset and return a new RegionEntryOverflow error when it wraps, so a malformed entry is rejected instead of being folded into a valid-looking range. The computed end is now reused for the region_entries map so the bound is only calculated once. Add a regression test for a wrapping entry. Signed-off-by: Sayed Kaif <[email protected]>
metsw24-max
added a commit
to metsw24-max/cloud-hypervisor
that referenced
this pull request
Jul 6, 2026
The region table overlap fix in RegionInfo::new computes each entry's end offset as `file_offset + length`. Both values are taken verbatim from the image, so a crafted or corrupt VHDX can set a file offset near u64::MAX and make that addition wrap. A wrapped end offset compares as a small value, which can slip a genuinely overlapping region past the half-open interval check that cloud-hypervisor#8483 added. Use checked_add for the end offset and return a new RegionEntryOverflow error when it wraps, so a malformed entry is rejected instead of being folded into a valid-looking range. The computed end is now reused for the region_entries map so the bound is only calculated once. Add a regression test for a wrapping entry. Signed-off-by: Sayed Kaif <[email protected]>
Alvov1
pushed a commit
to Alvov1/cloud-hypervisor
that referenced
this pull request
Jul 7, 2026
The region table overlap fix in RegionInfo::new computes each entry's end offset as `file_offset + length`. Both values are taken verbatim from the image, so a crafted or corrupt VHDX can set a file offset near u64::MAX and make that addition wrap. A wrapped end offset compares as a small value, which can slip a genuinely overlapping region past the half-open interval check that cloud-hypervisor#8483 added. Use checked_add for the end offset and return a new RegionEntryOverflow error when it wraps, so a malformed entry is rejected instead of being folded into a valid-looking range. The computed end is now reused for the region_entries map so the bound is only calculated once. Add a regression test for a wrapping entry. Signed-off-by: Sayed Kaif <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The region table overlap check in
RegionInfo::newonly rejected a newregion that strictly engulfed an existing one. Identical, fully
contained, and partially overlapping region entries passed undetected,
so a malformed VHDX with overlapping regions was wrongly accepted.
Per the MS-VHDX specification,
all region table objects MUST be non-overlapping. This corrects the
region-vs-region check by replacing the faulty predicate with a correct
half-open interval overlap test, extracted into a small pure helper
(
ranges_overlap).Scope: this fixes the region-vs-region check only; the broader VHDX
overlap validation remains tracked in #8009.