From: Thanos Makatos <[email protected]> While this isn't technically a bug, it's highly unlikely that the server wouldn't be writing an entire struct.
Signed-off-by: Thanos Makatos <[email protected]> Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO") Reviewed-by: Cédric Le Goater <[email protected]> Link: https://lore.kernel.org/qemu-devel/[email protected] Signed-off-by: Cédric Le Goater <[email protected]> --- hw/vfio-user/device.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c index 8350bb2c018504dbca50a4e9afbfc6be251f5b2a..3d12e8b2a20eb96fb1a8a944070d13bf0e049b67 100644 --- a/hw/vfio-user/device.c +++ b/hw/vfio-user/device.c @@ -165,6 +165,11 @@ static int vfio_user_get_region_info(VFIOUserProxy *proxy, } trace_vfio_user_get_region_info(msgp->index, msgp->flags, msgp->size); + if (msgp->argsz < sizeof(*info)) { + error_printf("vfio_user_get_region_info reply argsz too small\n"); + return -EINVAL; + } + memcpy(info, &msgp->argsz, info->argsz); /* -- 2.55.0
