vfio-user: vfio_user_device_io_set_irqs: prevent excessive malloc
This isn't in practise a problem since irq->argsz is not externally provided, it's a good hardening step nonetheless. Fixes: ca1add1696 ("vfio-user: implement VFIO_USER_DEVICE_GET/SET_IRQ*") Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260721122643.30985-10-thanos.makatos@nutanix.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
Thanos Makatos committed
Jul 21, 2026 at 12:27 UTC
aef1e7c5ec80ee7a4484e4903c9e4c47d80535de
1 file changed
+5
hw/vfio-user/device.c
+5
@@ -297,6 +297,11 @@ static int vfio_user_device_io_set_irqs(VFIODevice *vbasedev,
297
error_printf("vfio_user_set_irqs argsz too large\n");
298
return -E2BIG;
299
}
300
+ if (size > proxy->max_xfer_size) {
301
+ error_printf("vfio_user_device_io_set_irqs argsz too large\n");
302
+ return -E2BIG;
303
+ }
304
+
305
msgp = g_malloc0(size);
306
307
vfio_user_request_msg(&msgp->hdr, VFIO_USER_DEVICE_SET_IRQS, size, 0);