virtio-snd: check rx buffer descriptor size
It must be at least sizeof(virtio_snd_pcm_status). I haven't verified if it's possible to get an underflow, but coverity points it out in CID 1547527 so add a check. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20260420-virtio-fixups-v3-1-07aef1eff9d2@linaro.org>
Manos Pitsidianakis committed
Apr 20, 2026 at 08:07 UTC
bdac94e9cfdff4d9d3c1a6f7cd995e4e4f04d7a9
1 file changed
+5
-3
hw/audio/virtio-snd.c
+5
-3
@@ -970,12 +970,14 @@ static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)
970
}
971
972
stream = vsnd->pcm.streams[stream_id];
973
- if (stream == NULL || stream->info.direction != VIRTIO_SND_D_INPUT) {
973
+ size = iov_size(elem->in_sg, elem->in_num);
974
+ if (stream == NULL
975
+ || stream->info.direction != VIRTIO_SND_D_INPUT
976
+ || size < sizeof(virtio_snd_pcm_status)) {
977
goto rx_err;
978
}
979
+ size -= sizeof(virtio_snd_pcm_status);
980
WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {
977
- size = iov_size(elem->in_sg, elem->in_num) -
978
- sizeof(virtio_snd_pcm_status);
981
buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);
982
buffer->elem = elem;
983
buffer->vq = vq;