From: Thanos Makatos <[email protected]>
This isn't in practise a problem since feature->argsz is not externally
provided, it's a good hardening step nonetheless.
Fixes: e2358af5838d ("vfio-user: support VFIO_USER_DEVICE_FEATURE")
Signed-off-by: Thanos Makatos <[email protected]>
Reviewed-by: Cédric Le Goater <[email protected]>
Link:
https://lore.kernel.org/qemu-devel/[email protected]
Signed-off-by: Cédric Le Goater <[email protected]>
---
hw/vfio-user/device.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index
353fa5ee21e34a88bcd0eff9de40d9757387a616..8feaa568750ed1978dbc273da2054c89ad3bcc96
100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -87,6 +87,10 @@ vfio_user_device_io_device_feature(VFIODevice *vbasedev,
error_printf("vfio_user_device_io_device_feature argsz too large\n");
return -E2BIG;
}
+ if (size > proxy->max_xfer_size) {
+ error_printf("vfio_user_device_io_device_feature argsz too large\n");
+ return -E2BIG;
+ }
msgp = g_malloc0(size);
--
2.55.0
