diff options
| author | Stefan Hajnoczi | 2020-10-27 18:35:21 +0100 |
|---|---|---|
| committer | Michael S. Tsirkin | 2020-11-03 22:39:05 +0100 |
| commit | 9f6df01d0e128c2df179789b37140d6aeddfcb92 (patch) | |
| tree | 1774f2cd9fe7b8a8e9d17484673e904423a0ff15 /contrib/vhost-user-blk | |
| parent | block/export: fix vhost-user-blk get_config() information leak (diff) | |
| download | qemu-9f6df01d0e128c2df179789b37140d6aeddfcb92.tar.gz qemu-9f6df01d0e128c2df179789b37140d6aeddfcb92.tar.xz qemu-9f6df01d0e128c2df179789b37140d6aeddfcb92.zip | |
contrib/vhost-user-blk: fix get_config() information leak
Refuse get_config() in excess of sizeof(struct virtio_blk_config).
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20201027173528.213464-6-stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'contrib/vhost-user-blk')
| -rw-r--r-- | contrib/vhost-user-blk/vhost-user-blk.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/contrib/vhost-user-blk/vhost-user-blk.c b/contrib/vhost-user-blk/vhost-user-blk.c index 25eccd02b5..caad88637e 100644 --- a/contrib/vhost-user-blk/vhost-user-blk.c +++ b/contrib/vhost-user-blk/vhost-user-blk.c @@ -404,6 +404,8 @@ vub_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len) VugDev *gdev; VubDev *vdev_blk; + g_return_val_if_fail(len <= sizeof(struct virtio_blk_config), -1); + gdev = container_of(vu_dev, VugDev, parent); vdev_blk = container_of(gdev, VubDev, parent); memcpy(config, &vdev_blk->blkcfg, len); |