From: Jonathan Cameron Date: Fri, 1 Nov 2024 13:39:17 +0000 (+0000) Subject: hw/cxl: Ensure there is enough data to read the input header in cmd_get_physical_port... X-Git-Tag: v9.2.0-rc0~17^2~9 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=721c99aefcdb311bd41d20678d3935fd11454641;p=thirdparty%2Fqemu.git hw/cxl: Ensure there is enough data to read the input header in cmd_get_physical_port_state() If len_in is smaller than the header length then the accessing the number of ports will result in an out of bounds access. Add a check to avoid this. Reported-by: Esifiel Signed-off-by: Jonathan Cameron Message-Id: <20241101133917.27634-11-Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c index f4a436e1728..2d4d62c4545 100644 --- a/hw/cxl/cxl-mailbox-utils.c +++ b/hw/cxl/cxl-mailbox-utils.c @@ -530,6 +530,9 @@ static CXLRetCode cmd_get_physical_port_state(const struct cxl_cmd *cmd, in = (struct cxl_fmapi_get_phys_port_state_req_pl *)payload_in; out = (struct cxl_fmapi_get_phys_port_state_resp_pl *)payload_out; + if (len_in < sizeof(*in)) { + return CXL_MBOX_INVALID_PAYLOAD_LENGTH; + } /* Check if what was requested can fit */ if (sizeof(*out) + sizeof(*out->ports) * in->num_ports > cci->payload_max) { return CXL_MBOX_INVALID_INPUT;