On 13/07/2026 14.51, [email protected] wrote:
From: Marc-André Lureau <[email protected]>A malicious or buggy vhost-user-gpu backend can send messages with undersized payloads, leading to out-of-bounds reads when the handler accesses struct fields beyond the allocated buffer. However, vhost-user-gpu is considered trusted by QEMU by design (it has access to shared memory etc). Add a centralized minimum payload size check in vhost_user_gpu_chr_read() that rejects messages before dispatch, and a per-pixel bounds check in the VHOST_USER_GPU_UPDATE handler to ensure the variable-length data covers the declared width x height. Fixes: 267f66465 ("hw/display: add vhost-user-vga & gpu-pci") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3866 Reported-by: Feifan Qian <[email protected]> Signed-off-by: Marc-André Lureau <[email protected]> --- hw/display/vhost-user-gpu.c | 38 +++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+)
Reviewed-by: Thomas Huth <[email protected]>
