storing files as byte array in db, security risk?

[Grygechta]

We have an asp.net application that allows users to upload files, the files are saved to temporary disk location and later attached to a record and saved in DB. My question pertains to security and/or virus issues. Are there any security holes in this approach? Can a virus cause harm if it is never executed (file is saved, then opened using filestream, converted to byte array and saved to DB.Later, when the file is needed we stream the file back to user.The files are saved to a folder on the web server like this:\[code\]context.Request.Files[0].SaveAs();\[/code\] (location is a folder under app_data/files)later when the same user creates a record we grab the file from disk and store it in db like this:\[code\]FileStream fileStream = File.OpenRead(currentFilePath);byte[] ba = new byte[fileStream.Length];int len = fileStream.Read(ba, 0, ba.Length);//ba saved to DB here as varbinary(max)\[/code\]We limit the files that can be uploaded to this list:\[code\]List<string> supportedExtensions = new List<string>(10) {".txt", ".xls", ".xlsx", ".doc", ".docx", ".eps", ".jpg", ".jpeg", ".gif", ".png", ".bmp", ".rar", ".zip", ".rtf", ".csv", ".psd", ".pdf" };\[/code\]The file is streamed back to user's web browser like this:\[code\]//emA = entity object loaded from DBcontext.Response.AppendHeader("Content-Disposition", "inline; filename=\"" + emA.FileName + "\"");context.Response.AddHeader("Content-Type", emA.ContentType);context.Response.BinaryWrite(emA.FileContent);\[/code\]