From: Thanos Makatos <[email protected]>
This isn't in practise a problem since irq->argsz is not
externally provided, it's a good hardening step nonetheless.
Fixes: ca1add1696 ("vfio-user: implement VFIO_USER_DEVICE_GET/SET_IRQ*")
Signed-off-by: Thanos Makatos <[email protected]>
Reviewed-by: Cédric Le Goater <[email protected]>
Link:
https://lore.kernel.org/qemu-devel/[email protected]
Signed-off-by: Cédric Le Goater <[email protected]>
---
hw/vfio-user/device.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index
8feaa568750ed1978dbc273da2054c89ad3bcc96..daac0e21b6b8fd5f91e3bb52044871b18021d337
100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -293,7 +293,10 @@ static int vfio_user_device_io_set_irqs(VFIODevice
*vbasedev,
* Handle simple case
*/
if ((irq->flags & VFIO_IRQ_SET_DATA_EVENTFD) == 0) {
- size = sizeof(VFIOUserHdr) + irq->argsz;
+ if (__builtin_add_overflow(irq->argsz, sizeof(VFIOUserHdr), &size)) {
+ error_printf("vfio_user_set_irqs argsz too large\n");
+ return -E2BIG;
+ }
msgp = g_malloc0(size);
vfio_user_request_msg(&msgp->hdr, VFIO_USER_DEVICE_SET_IRQS, size, 0);
--
2.55.0
