On Tue, 20 Oct 2026 at 22:20, Harshit Mukhedkar <[email protected]> wrote: > > Migration streams are untrusted input. A crafted stream can set > blk_len larger than the 512 byte data[] buffer, so a later block > read passes that length to blk_pread() and overflows data[] on > the host heap. > > Reject such state in post_load. > > Cc: [email protected] > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4725 > Reported-by: Karl Mehltretter > Signed-off-by: Harshit Mukhedkar <[email protected]> > --- > hw/sd/sd.c | 13 +++++++++++++ > 1 file changed, 13 insertions(+)
Reviewed-by: Peter Maydell <[email protected]> thanks -- PMM
