Commit abd7f08b authored by Prasad J Pandit's avatar Prasad J Pandit Committed by Gerd Hoffmann
Browse files

display: virtio-gpu-3d: check virgl capabilities max_size 



Virtio GPU device while processing 'VIRTIO_GPU_CMD_GET_CAPSET'
command, retrieves the maximum capabilities size to fill in the
response object. It continues to fill in capabilities even if
retrieved 'max_size' is zero(0), thus resulting in OOB access.
Add check to avoid it.

Reported-by: default avatarZhenhao Hong <zhenhaohong@gmail.com>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Message-id: 20161214070156.23368-1-ppandit@redhat.com
Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent 6a928d25

hw/display/virtio-gpu-3d.c

+5 −1
Original line number Diff line number Diff line
@@ -371,8 +371,12 @@ static void virgl_cmd_get_capset(VirtIOGPU *g, 


    virgl_renderer_get_cap_set(gc.capset_id, &max_ver,

                               &max_size);

    resp = g_malloc(sizeof(*resp) + max_size);

    if (!max_size) {

        cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;

        return;

    }



    resp = g_malloc(sizeof(*resp) + max_size);

    resp->hdr.type = VIRTIO_GPU_RESP_OK_CAPSET;

    virgl_renderer_fill_caps(gc.capset_id,

                             gc.capset_version,