@samitouri / QOSamiQemu / commits / 7994203bb1

virtio-snd: tighten read amount in in_cb

The amount of bytes to read passed to AUD_read() should never surpass the maximum available buffer length. Tighten the current amount by MIN(<amount>, max_size - <existing size>). Cc: qemu-stable@nongnu.org Fixes: 98e77e3dd8dd6e7aa9a7dffa60f49c8c8a49d4e3 ("virtio-snd: add max size bounds check in input cb") Reported-by: DARKNAVY <vr@darknavy.com> Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20260220-virtio-snd-series-v1-5-207c4f7200a2@linaro.org>

Manos Pitsidianakis committed Feb 20, 2026 at 11:40 UTC 7994203bb1b83a6604f3ab00fe9598909bb66164
1 file changed +6 -4
hw/audio/virtio-snd.c
+6 -4
@@ -1250,7 +1250,7 @@ static void virtio_snd_pcm_in_cb(void *data, int available)
1250 {
1251 VirtIOSoundPCMStream *stream = data;
1252 VirtIOSoundPCMBuffer *buffer;
1253 - size_t size, max_size;
1253 + size_t size, max_size, to_read;
1254
1255 WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {
1256 while (!QSIMPLEQ_EMPTY(&stream->queue)) {
@@ -1276,10 +1276,12 @@ static void virtio_snd_pcm_in_cb(void *data, int available)
1276 return_rx_buffer(stream, buffer);
1277 break;
1278 }
1279 + to_read = stream->params.period_bytes - buffer->size;
1280 + to_read = MIN(to_read, available);
1281 + to_read = MIN(to_read, max_size - buffer->size);
1282 size = AUD_read(stream->voice.in,
1280 - buffer->data + buffer->size,
1281 - MIN(available, (stream->params.period_bytes -
1282 - buffer->size)));
1283 + buffer->data + buffer->size,
1284 + to_read);
1285 if (!size) {
1286 available = 0;
1287 break;