From: Thanos Makatos <[email protected]>
This isn't in practise a problem since irq->argsz is not externally
provided, it's a good hardening step nonetheless.
Fixes: ca1add1696 ("vfio-user: implement VFIO_USER_DEVICE_GET/SET_IRQ*")
Signed-off-by: Thanos Makatos <[email protected]>
Reviewed-by: Cédric Le Goater <[email protected]>
Link:
https://lore.kernel.org/qemu-devel/[email protected]
Signed-off-by: Cédric Le Goater <[email protected]>
---
hw/vfio-user/device.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index
daac0e21b6b8fd5f91e3bb52044871b18021d337..1a01e748cd43311cea65c749288fc2003064db09
100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -297,6 +297,11 @@ static int vfio_user_device_io_set_irqs(VFIODevice
*vbasedev,
error_printf("vfio_user_set_irqs argsz too large\n");
return -E2BIG;
}
+ if (size > proxy->max_xfer_size) {
+ error_printf("vfio_user_device_io_set_irqs argsz too large\n");
+ return -E2BIG;
+ }
+
msgp = g_malloc0(size);
vfio_user_request_msg(&msgp->hdr, VFIO_USER_DEVICE_SET_IRQS, size, 0);
--
2.55.0
