diff options
author | Thanos Makatos <thanos.makatos@nutanix.com> | 2020-12-16 11:03:03 -0500 |
---|---|---|
committer | Thanos Makatos <tmakatos@gmail.com> | 2020-12-17 09:21:46 +0000 |
commit | 5273475d4798c5e4fe2d73775e96f2cd3acf3e97 (patch) | |
tree | 8c0ca294a73e6495b44ced29d6425d360cf7b206 /lib | |
parent | 545a268510c270ec537134f8050fe7ec5a1f0f51 (diff) | |
download | libvfio-user-5273475d4798c5e4fe2d73775e96f2cd3acf3e97.zip libvfio-user-5273475d4798c5e4fe2d73775e96f2cd3acf3e97.tar.gz libvfio-user-5273475d4798c5e4fe2d73775e96f2cd3acf3e97.tar.bz2 |
validate region is segment
Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com>
Diffstat (limited to 'lib')
-rw-r--r-- | lib/dma.h | 8 |
1 files changed, 8 insertions, 0 deletions
@@ -74,6 +74,7 @@ #include <stdint.h> #include <stdlib.h> #include <limits.h> +#include <errno.h> #include "libvfio-user.h" #include "common.h" @@ -237,7 +238,14 @@ dma_map_sg(dma_controller_t *dma, const dma_sg_t *sg, struct iovec *iov, dma_memory_region_t *region; int i; + assert(dma != NULL); + assert(sg != NULL); + assert(iov != NULL); + for (i = 0; i < cnt; i++) { + if (sg[i].region >= dma->nregions) { + return -EINVAL; + } vfu_log(dma->vfu_ctx, LOG_DEBUG, "map %#lx-%#lx\n", sg->dma_addr + sg->offset, sg->dma_addr + sg->offset + sg->length); region = &dma->regions[sg[i].region]; |