diff options
| author | Jonathan Cameron <Jonathan.Cameron@huawei.com> | 2024-11-01 13:39:14 +0000 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2024-11-04 16:03:25 -0500 |
| commit | c0f122419fbcd1e0bf2bc2a0a3ae6410bb2cda22 (patch) | |
| tree | 7199bd0ba33b35df49be2021288eedeae011b445 /hw | |
| parent | a3de73c2a835efc30851f9e810e0cd355e1cd0cf (diff) | |
| download | qemu-c0f122419fbcd1e0bf2bc2a0a3ae6410bb2cda22.zip qemu-c0f122419fbcd1e0bf2bc2a0a3ae6410bb2cda22.tar.gz qemu-c0f122419fbcd1e0bf2bc2a0a3ae6410bb2cda22.tar.bz2 | |
hw/cxl: Ensuring enough data to read parameters in cmd_tunnel_management_cmd()
If len_in is less than the minimum spec allowed value, then return
CXL_MBOX_INVALID_PAYLOAD_LENGTH
Reported-by: Esifiel <esifiel@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20241101133917.27634-8-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/cxl/cxl-mailbox-utils.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c index 5e57195..a40d812 100644 --- a/hw/cxl/cxl-mailbox-utils.c +++ b/hw/cxl/cxl-mailbox-utils.c @@ -151,6 +151,9 @@ static CXLRetCode cmd_tunnel_management_cmd(const struct cxl_cmd *cmd, in = (void *)payload_in; out = (void *)payload_out; + if (len_in < sizeof(*in)) { + return CXL_MBOX_INVALID_PAYLOAD_LENGTH; + } /* Enough room for minimum sized message - no payload */ if (in->size < sizeof(in->ccimessage)) { return CXL_MBOX_INVALID_PAYLOAD_LENGTH; |