diff options
| author | Jonathan Cameron <Jonathan.Cameron@huawei.com> | 2024-11-08 17:58:14 +0000 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2024-11-26 17:18:06 -0500 |
| commit | c5e36a5a6adbab7f6dc17d3bcb7b06660995cdc3 (patch) | |
| tree | 210e8e8ff5460b630493296eaeaf1fe5bd802ec5 | |
| parent | e50a24ead1c0b39673060aa90466ab8ef246297f (diff) | |
| download | qemu-c5e36a5a6adbab7f6dc17d3bcb7b06660995cdc3.zip qemu-c5e36a5a6adbab7f6dc17d3bcb7b06660995cdc3.tar.gz qemu-c5e36a5a6adbab7f6dc17d3bcb7b06660995cdc3.tar.bz2 | |
hw/cxl: Check for zero length features in cmd_features_set_feature()
Zero length data for features doesn't make any sense so exclude that case
early. This fixes the undefined behavior reported by coverity for a zero
length memcpy().
Resolves CID 1564900 and 1564901
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20241108175814.1248278-1-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| -rw-r--r-- | hw/cxl/cxl-mailbox-utils.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c index 2d4d62c..ce9aa18 100644 --- a/hw/cxl/cxl-mailbox-utils.c +++ b/hw/cxl/cxl-mailbox-utils.c @@ -1288,6 +1288,10 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd, set_feat_info->data_offset = hdr->offset; bytes_to_copy = len_in - sizeof(CXLSetFeatureInHeader); + if (bytes_to_copy == 0) { + return CXL_MBOX_INVALID_PAYLOAD_LENGTH; + } + if (qemu_uuid_is_equal(&hdr->uuid, &patrol_scrub_uuid)) { if (hdr->version != CXL_MEMDEV_PS_SET_FEATURE_VERSION) { return CXL_MBOX_UNSUPPORTED; |