From: Manos Pitsidianakis <[email protected]> It must be at least sizeof(virtio_snd_pcm_status).
I haven't verified if it's possible to get an underflow, but coverity points it out in CID 1547527 so add a check. Reviewed-by: Alex Bennée <[email protected]> Signed-off-by: Manos Pitsidianakis <[email protected]> Reviewed-by: Michael S. Tsirkin <[email protected]> Signed-off-by: Michael S. Tsirkin <[email protected]> Message-ID: <[email protected]> --- hw/audio/virtio-snd.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c index fb5cff3866..93fbcfb43f 100644 --- a/hw/audio/virtio-snd.c +++ b/hw/audio/virtio-snd.c @@ -970,12 +970,14 @@ static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq) } stream = vsnd->pcm.streams[stream_id]; - if (stream == NULL || stream->info.direction != VIRTIO_SND_D_INPUT) { + size = iov_size(elem->in_sg, elem->in_num); + if (stream == NULL + || stream->info.direction != VIRTIO_SND_D_INPUT + || size < sizeof(virtio_snd_pcm_status)) { goto rx_err; } + size -= sizeof(virtio_snd_pcm_status); WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) { - size = iov_size(elem->in_sg, elem->in_num) - - sizeof(virtio_snd_pcm_status); buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); buffer->elem = elem; buffer->vq = vq; -- MST
