diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2018-12-13 01:00:34 +0530 |
|---|---|---|
| committer | Marcel Apfelbaum <marcel.apfelbaum@gmail.com> | 2018-12-22 11:09:57 +0200 |
| commit | 0e68373cc2b3a063ce067bc0cc3edaf370752890 (patch) | |
| tree | aaf689ada6d7b8f1cc0dcde50100213a86470762 /qemu-edid.c | |
| parent | cce648613bc802be1b894227f7fd94d88476ea07 (diff) | |
| download | qemu-0e68373cc2b3a063ce067bc0cc3edaf370752890.zip qemu-0e68373cc2b3a063ce067bc0cc3edaf370752890.tar.gz qemu-0e68373cc2b3a063ce067bc0cc3edaf370752890.tar.bz2 | |
rdma: check num_sge does not exceed MAX_SGE
rdma back-end has scatter/gather array ibv_sge[MAX_SGE=4] set
to have 4 elements. A guest could send a 'PvrdmaSqWqe' ring element
with 'num_sge' set to > MAX_SGE, which may lead to OOB access issue.
Add check to avoid it.
Reported-by: Saar Amar <saaramar5@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Diffstat (limited to 'qemu-edid.c')
0 files changed, 0 insertions, 0 deletions