security: validate QCOW2 ClusterBits to prevent OOM from crafted headers

[adilburaksen]

Summary

parseHeader in extractor/filesystem/embeddedfs/qcow2/format.go does not validate the ClusterBits field from the QCOW2 header. Every code path that computes clusterSize = uint64(1) << header.ClusterBits then passes that value directly to make() or bytes.Repeat() without bounds checking.

Impact: A 116-byte crafted .qcow2 file with ClusterBits=33 causes scalibr to attempt an 8 GB heap allocation inside readL2Table, crashing the process with runtime: out of memory. Values up to 62 produce allocations up to 4 EB.

Root Cause

// format.go:218 — no bounds check on ClusterBits before here
clusterSize := uint64(1) << header.ClusterBits
buf := make([]byte, clusterSize)   // ← OOM with attacker-controlled value

Same pattern at: readRefcountBlock:316, readCluster:232, writeRawImage:340.

Fix

Validate ClusterBits against the QCOW2 spec (9–21) in parseHeader, before any clusterSize is computed:

if h.ClusterBits < 9 || h.ClusterBits > 21 {
    return nil, nil, fmt.Errorf("ClusterBits %d out of valid range [9, 21]", h.ClusterBits)
}

Test

TestConvertQCOW2ClusterBitsRejected in security_regression_test.go:

• Pre-fix: 116-byte input → runtime: out of memory at readL2Table:format.go:218
• Post-fix: 116-byte input → immediate parse error, TotalAlloc delta = 0 MB

All existing qcow2 tests pass (18/18).

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[adilburaksen]

Updated with two additional fixes per code review:

• L1Size bounds check (prevents 4 GB alloc via make([]uint64, L1Size))
• RefcountTableClusters bounds check (prevents ~4 GB alloc via uint32 overflow in readRefcountTable)

All 38 tests pass.

[adilburaksen]

Hi! Just a friendly ping — all CI checks are passing. Happy to address any review feedback whenever you get a chance. Thanks for your time!