fuzz: add a fuzzer for the qcow2 converter

Browse Source

systemd-importd runs qcow2_detect()/qcow2_convert() over images it has just
downloaded (see pull-raw.c), so the header, the L1/L2 tables and every offset
and cluster descriptor in them are attacker controlled. There is a manual test
for the happy path, but nothing that feeds it a malformed image.

The corpus is two images, a plain data cluster and a zlib-compressed one (i.e.
decompress_zlib_raw()), at the 512 byte minimum cluster size and trimmed to the
last byte the converter reads, so 2K each. A zero cluster and a QCOW3 header are
a flipped descriptor bit and a bumped version field away from these, so they are
left to the fuzzer rather than carried in the tree.

...

This commit is contained in:

Armaan Sandhu

2026-09-01 11:41:19 -04:00

parent 43cd946f98

commit 65c112007a

4 changed files with 36 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

test/fuzz/fuzz-qcow2/compressed-cluster

BIN

Binary file not shown.

test/fuzz/fuzz-qcow2/plain-cluster

BIN

Binary file not shown.