virtio-snd: tighten read amount in in_cb
The amount of bytes to read passed to AUD_read() should never surpass the maximum available buffer length. Tighten the current amount by MIN(<amount>, max_size - <existing size>). Cc: qemu-stable@nongnu.org Fixes: 98e77e3dd8dd6e7aa9a7dffa60f49c8c8a49d4e3 ("virtio-snd: add max size bounds check in input cb") Reported-by: DARKNAVY <vr@darknavy.com> Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20260220-virtio-snd-series-v1-5-207c4f7200a2@linaro.org>
Manos Pitsidianakis committed
Feb 20, 2026 at 11:40 UTC
7994203bb1b83a6604f3ab00fe9598909bb66164
1 file changed
+6
-4
hw/audio/virtio-snd.c
+6
-4
@@ -1250,7 +1250,7 @@ static void virtio_snd_pcm_in_cb(void *data, int available)
1250
{
1251
VirtIOSoundPCMStream *stream = data;
1252
VirtIOSoundPCMBuffer *buffer;
1253
- size_t size, max_size;
1253
+ size_t size, max_size, to_read;
1254
1255
WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {
1256
while (!QSIMPLEQ_EMPTY(&stream->queue)) {
@@ -1276,10 +1276,12 @@ static void virtio_snd_pcm_in_cb(void *data, int available)
1276
return_rx_buffer(stream, buffer);
1277
break;
1278
}
1279
+ to_read = stream->params.period_bytes - buffer->size;
1280
+ to_read = MIN(to_read, available);
1281
+ to_read = MIN(to_read, max_size - buffer->size);
1282
size = AUD_read(stream->voice.in,
1280
- buffer->data + buffer->size,
1281
- MIN(available, (stream->params.period_bytes -
1282
- buffer->size)));
1283
+ buffer->data + buffer->size,
1284
+ to_read);
1285
if (!size) {
1286
available = 0;
1287
break;