vfio-user: vfio_user_device_io_device_feature: prevent buffer overflow
This isn't in practise a problem since feature->argsz is not externally provided, it's a good hardening step nonetheless. Fixes: e2358af5838d ("vfio-user: support VFIO_USER_DEVICE_FEATURE") Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260721122643.30985-7-thanos.makatos@nutanix.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
Thanos Makatos committed
Jul 21, 2026 at 12:26 UTC
5f0cbed64c0fe153b58331c223f0afbf84f299c7
1 file changed
+6
-1
hw/vfio-user/device.c
+6
-1
@@ -79,9 +79,14 @@ vfio_user_device_io_device_feature(VFIODevice *vbasedev,
79
struct vfio_device_feature *feature)
80
{
81
g_autofree VFIOUserDeviceFeature *msgp = NULL;
82
- int size = sizeof(VFIOUserHdr) + feature->argsz;
82
VFIOUserProxy *proxy = vbasedev->proxy;
83
Error *local_err = NULL;
84
+ int size;
85
+
86
+ if (__builtin_add_overflow(feature->argsz, sizeof(VFIOUserHdr), &size)) {
87
+ error_printf("vfio_user_device_io_device_feature argsz too large\n");
88
+ return -E2BIG;
89
+ }
90
91
msgp = g_malloc0(size);
92