vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546)
authorLi Qiang <liq3ea@163.com>
Sun, 16 May 2021 03:04:02 +0000 (20:04 -0700)
committerGerd Hoffmann <kraxel@redhat.com>
Thu, 27 May 2021 09:55:59 +0000 (11:55 +0200)
commit9f22893adcb02580aee5968f32baa2cd109b3ec2
tree0c7ed9e162d074886ac73269a15b677c023a6714
parent63736af5a6571d9def93769431e0d7e38c6677bf
vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546)

If 'virgl_cmd_get_capset' set 'max_size' to 0,
the 'virgl_renderer_fill_caps' will write the data after the 'resp'.
This patch avoid this by checking the returned 'max_size'.

virtio-gpu fix: abd7f08b23 ("display: virtio-gpu-3d: check
virgl capabilities max_size")

Fixes: CVE-2021-3546
Reported-by: Li Qiang <liq3ea@163.com>
Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Li Qiang <liq3ea@163.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20210516030403.107723-8-liq3ea@163.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
contrib/vhost-user-gpu/virgl.c