On Wed, Jul 08, 2026 at 04:41:12PM +0200, Laurent Vivier wrote: > The migration restore path reads nr_active_ports from the incoming > stream and passes it directly to fetch_active_ports_list(), which > uses it to size a heap allocation. A crafted migration stream can set > this field to a very large value, causing QEMU to attempt a > multi-gigabyte allocation and abort. > > Fix this by checking nr_active_ports against the configured > max_virtserial_ports before calling fetch_active_ports_list(). > > Cc: [email protected] > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3801 > Signed-off-by: Laurent Vivier <[email protected]> > --- > hw/char/virtio-serial-bus.c | 4 ++++ > 1 file changed, 4 insertions(+)
Reviewed-by: Daniel P. Berrangé <[email protected]> With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
