[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH 1/7] vhost-user-gpu: fix memory disclosure in virgl_cmd_get_c

From: P J P
Subject: Re: [PATCH 1/7] vhost-user-gpu: fix memory disclosure in virgl_cmd_get_capset_info
Date: Thu, 6 May 2021 11:23:29 +0530 (IST)

+-- On Wed, 5 May 2021, Li Qiang wrote --+
| P J P <ppandit@redhat.com> 于2021年5月5日周三 下午3:24写道:
| > -   vg_ctrl_response(g, cmd, &resp.hdr, sizeof(resp));
| > +   vg_ctrl_response(g, cmd, &resp.hdr, sizeof(resp.hdr));
| >
| > * While memset(3) is okay, should it also send header(hdr) size as 
| I don't think so. This function also set fields other than header such
| as 'resp.capset_id', 'resp.capset_max_version' and so on.

But it is passing 'resp.hdr' reference as parameter and size of 'resp' as 

  sizeof(struct virtio_gpu_ctrl_hdr): 24
  sizeof(struct virtio_gpu_resp_capset_info): 40

It may cause OOB access.

Thank you.
 - P J P
8685 545E B54C 486B C6EB 271E E285 8B5A F050 DE8D

reply via email to

[Prev in Thread] Current Thread [Next in Thread]