mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

hw/cxl: Ensuring enough data to read parameters in cmd_tunnel_management_cmd()

Browse Source 
If len_in is less than the minimum spec allowed value, then return
CXL_MBOX_INVALID_PAYLOAD_LENGTH

Reported-by: Esifiel <esifiel@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20241101133917.27634-8-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
Jonathan Cameron 2024-11-01 13:39:14 +00:00 committed by Michael S. Tsirkin
parent a3de73c2a8
commit c0f122419f
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
hw/cxl/cxl-mailbox-utils.c
View File

@ -151,6 +151,9 @@ static CXLRetCode cmd_tunnel_management_cmd(const struct cxl_cmd *cmd,
in = (void *)payload_in; in = (void *)payload_in;
out = (void *)payload_out; out = (void *)payload_out;
if (len_in < sizeof(*in)) {
return CXL_MBOX_INVALID_PAYLOAD_LENGTH;
}
/* Enough room for minimum sized message - no payload */ /* Enough room for minimum sized message - no payload */
if (in->size < sizeof(in->ccimessage)) { if (in->size < sizeof(in->ccimessage)) {
return CXL_MBOX_INVALID_PAYLOAD_LENGTH; return CXL_MBOX_INVALID_PAYLOAD_LENGTH;