Re: [PATCH] storage: check bounds before accessing encryption payload offset

On Fri, Aug 14, 2026 at 14:07:25 +0300, Sergey Zhidkih wrote:

'virStorageFileGetEncryptionPayloadOffset' expects payloadOffset + 4 to be in buffer bounds which isn't checked anywhere.

For example malicious actor may provide LUKS header with just magic and version like: '4c554b53 babe 0001'. This example successefully passes 'virStorageFileHasEncryptionFormat' and leads to OOB read of 4 bytes.

So the fix is to add bounds checks.

Fixes: b7d44f450c06803df7df3ad380f7a5c97425c1e6 Closes: https://gitlab.com/libvirt/libvirt/-/work_items/906

Signed-off-by: Sergey Zhidkih <rx1513@altlinux.org> --- src/storage_file/storage_file_probe.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)

Reviewed-by: Peter Krempa <pkrempa@redhat.com> and pushed