@samitouri / QOSamiQemu / commits / bcb53328aa

virtio-snd: fix max_size bounds check in input cb

In 98e77e3d we calculated the max size and checked that each buffer is smaller than it. We neglected to subtract the size of the virtio_snd_pcm_status header from the max size, and max_size was thus larger than the correct value, leading to potential OOB writes. If the buffer cannot fit the header or can fit only the header, return the buffer immediately. Cc: qemu-stable@nongnu.org Fixes: 98e77e3dd8dd6e7aa9a7dffa60f49c8c8a49d4e3 ("virtio-snd: add max size bounds check in input cb") Reported-by: DARKNAVY <vr@darknavy.com> Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20260220-virtio-snd-series-v1-4-207c4f7200a2@linaro.org>

Manos Pitsidianakis committed Feb 20, 2026 at 11:40 UTC bcb53328aa70023f1405fade4e253e7f77567261

1 file changed +6

hw/audio/virtio-snd.c

@@ -1265,6 +1265,12 @@ static void virtio_snd_pcm_in_cb(void *data, int available)

1265 }

1266

1267 max_size = iov_size(buffer->elem->in_sg, buffer->elem->in_num);

1268 + if (max_size <= sizeof(virtio_snd_pcm_status)) {

1269 + return_rx_buffer(stream, buffer);

1270 + continue;

1271 + }

1272 + max_size -= sizeof(virtio_snd_pcm_status);

1273 +

1274 for (;;) {

1275 if (buffer->size >= max_size) {

1276 return_rx_buffer(stream, buffer);