Re: [PATCH qemu 04/10] hw/cxl: Check enough data in cmd_firmware_update_transfer()

On Fri, Nov 01, 2024 at 01:39:11PM +, Jonathan Cameron wrote: > Buggy guest can write a message that advertises more data that > is provided. As QEMU internally duplicates the reported message > size, this may result in an out of bounds access. > Add sanity checks on the size to avoid this. >

[PATCH qemu 04/10] hw/cxl: Check enough data in cmd_firmware_update_transfer()

Buggy guest can write a message that advertises more data that is provided. As QEMU internally duplicates the reported message size, this may result in an out of bounds access. Add sanity checks on the size to avoid this. Reported-by: Esifiel Signed-off-by: Jonathan Cameron --- hw/cxl/cxl-mailb