From 9f6df01d0e128c2df179789b37140d6aeddfcb92 Mon Sep 17 00:00:00 2001 From: Stefan Hajnoczi Date: Tue, 27 Oct 2020 17:35:21 +0000 Subject: [PATCH] contrib/vhost-user-blk: fix get_config() information leak Refuse get_config() in excess of sizeof(struct virtio_blk_config). Signed-off-by: Stefan Hajnoczi Message-Id: <20201027173528.213464-6-stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- contrib/vhost-user-blk/vhost-user-blk.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/contrib/vhost-user-blk/vhost-user-blk.c b/contrib/vhost-user-blk/vhost-user-blk.c index 25eccd02b5..caad88637e 100644 --- a/contrib/vhost-user-blk/vhost-user-blk.c +++ b/contrib/vhost-user-blk/vhost-user-blk.c @@ -404,6 +404,8 @@ vub_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len) VugDev *gdev; VubDev *vdev_blk; + g_return_val_if_fail(len <= sizeof(struct virtio_blk_config), -1); + gdev = container_of(vu_dev, VugDev, parent); vdev_blk = container_of(gdev, VubDev, parent); memcpy(config, &vdev_blk->blkcfg, len);