From: Stefan Hajnoczi <stefa...@redhat.com>
Refuse get_config() in excess of sizeof(struct virtio_blk_config).
Signed-off-by: Stefan Hajnoczi <stefa...@redhat.com>
Message-Id: <20201027173528.213464-6-stefa...@redhat.com>
Reviewed-by: Michael S. Tsirkin <m...@redhat.com>
Signed-off-by: Michael S. Tsirkin <m...@redhat.com>
---
contrib/vhost-user-blk/vhost-user-blk.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/contrib/vhost-user-blk/vhost-user-blk.c
b/contrib/vhost-user-blk/vhost-user-blk.c
index 25eccd02b5..caad88637e 100644
--- a/contrib/vhost-user-blk/vhost-user-blk.c
+++ b/contrib/vhost-user-blk/vhost-user-blk.c
@@ -404,6 +404,8 @@ vub_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len)
VugDev *gdev;
VubDev *vdev_blk;
+ g_return_val_if_fail(len <= sizeof(struct virtio_blk_config), -1);
+
gdev = container_of(vu_dev, VugDev, parent);
vdev_blk = container_of(gdev, VubDev, parent);
memcpy(config, &vdev_blk->blkcfg, len);
--
MST
