mirror of
https://github.com/Jeffrey-Sardina/liberated-systemd.git
synced 2026-10-22 02:52:47 -05:00
Armaan Sandhu
65c112007a
systemd-importd runs qcow2_detect()/qcow2_convert() over images it has just downloaded (see pull-raw.c), so the header, the L1/L2 tables and every offset and cluster descriptor in them are attacker controlled. There is a manual test for the happy path, but nothing that feeds it a malformed image. The corpus is two images, a plain data cluster and a zlib-compressed one (i.e. decompress_zlib_raw()), at the 512 byte minimum cluster size and trimmed to the last byte the converter reads, so 2K each. A zero cluster and a QCOW3 header are a flipped descriptor bit and a bumped version field away from these, so they are left to the fuzzer rather than carried in the tree.