diff options
| author | Stefan Hajnoczi <stefanha@redhat.com> | 2020-10-27 17:35:21 +0000 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2020-11-03 16:39:05 -0500 |
| commit | 9f6df01d0e128c2df179789b37140d6aeddfcb92 (patch) | |
| tree | 1774f2cd9fe7b8a8e9d17484673e904423a0ff15 /contrib | |
| parent | f8ffcb2bda22bad8e91da70c28ec52724a054f92 (diff) | |
contrib/vhost-user-blk: fix get_config() information leak
Refuse get_config() in excess of sizeof(struct virtio_blk_config).
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20201027173528.213464-6-stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'contrib')
| -rw-r--r-- | contrib/vhost-user-blk/vhost-user-blk.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/contrib/vhost-user-blk/vhost-user-blk.c b/contrib/vhost-user-blk/vhost-user-blk.c index 25eccd02b5..caad88637e 100644 --- a/contrib/vhost-user-blk/vhost-user-blk.c +++ b/contrib/vhost-user-blk/vhost-user-blk.c @@ -404,6 +404,8 @@ vub_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len) VugDev *gdev; VubDev *vdev_blk; + g_return_val_if_fail(len <= sizeof(struct virtio_blk_config), -1); + gdev = container_of(vu_dev, VugDev, parent); vdev_blk = container_of(gdev, VubDev, parent); memcpy(config, &vdev_blk->blkcfg, len); |