@samitouri / QOSamiQemu / commits / 761ac964a8

vfio-user: vfio_user_device_io_device_feature: prevent excessive malloc

This isn't in practise a problem since feature->argsz is not externally provided, it's a good hardening step nonetheless. Fixes: e2358af5838d ("vfio-user: support VFIO_USER_DEVICE_FEATURE") Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260721122643.30985-8-thanos.makatos@nutanix.com Signed-off-by: Cédric Le Goater <clg@redhat.com>

Thanos Makatos committed Jul 21, 2026 at 12:26 UTC 761ac964a8a42f3d8b92dca150754c0cc8cbc560
1 file changed +4
hw/vfio-user/device.c
+4
@@ -87,6 +87,10 @@ vfio_user_device_io_device_feature(VFIODevice *vbasedev,
87 error_printf("vfio_user_device_io_device_feature argsz too large\n");
88 return -E2BIG;
89 }
90 + if (size > proxy->max_xfer_size) {
91 + error_printf("vfio_user_device_io_device_feature argsz too large\n");
92 + return -E2BIG;
93 + }
94
95 msgp = g_malloc0(size);
96