+-- On Wed, 5 May 2021, Li Qiang wrote --+ | P J P <ppan...@redhat.com> 于2021年5月5日周三 下午3:24写道： | > - vg_ctrl_response(g, cmd, &resp.hdr, sizeof(resp)); | > + vg_ctrl_response(g, cmd, &resp.hdr, sizeof(resp.hdr)); | > | > * While memset(3) is okay, should it also send header(hdr) size as 'resp_len'? | | I don't think so. This function also set fields other than header such | as 'resp.capset_id', 'resp.capset_max_version' and so on.
But it is passing 'resp.hdr' reference as parameter and size of 'resp' as length. sizeof(struct virtio_gpu_ctrl_hdr): 24 sizeof(struct virtio_gpu_resp_capset_info): 40 It may cause OOB access. Thank you. -- - P J P 8685 545E B54C 486B C6EB 271E E285 8B5A F050 DE8D
