diff options
| author | Manos Pitsidianakis <manos.pitsidianakis@linaro.org> | 2026-02-20 11:40:16 +0200 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2026-02-23 21:55:43 +0300 |
| commit | f26c7b05a64d49073ec910599a8870b00897042a (patch) | |
| tree | 5534d84912579699caa792b1e55322cbec21c088 | |
| parent | 4e6f36d19069f7bc6be3da2593db1275e7cc8b47 (diff) | |
| download | qemu-f26c7b05a64d49073ec910599a8870b00897042a.tar.gz qemu-f26c7b05a64d49073ec910599a8870b00897042a.zip | |
virtio-snd: tighten read amount in in_cb
The amount of bytes to read passed to AUD_read() should never surpass
the maximum available buffer length. Tighten the current amount by
MIN(<amount>, max_size - <existing size>).
Cc: qemu-stable@nongnu.org
Fixes: 98e77e3dd8dd6e7aa9a7dffa60f49c8c8a49d4e3 ("virtio-snd: add max size bounds check in input cb")
Reported-by: DARKNAVY <vr@darknavy.com>
Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260220-virtio-snd-series-v1-5-207c4f7200a2@linaro.org>
(cherry picked from commit 7994203bb1b83a6604f3ab00fe9598909bb66164)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | hw/audio/virtio-snd.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c index effae20bf0..32b3ea48b3 100644 --- a/hw/audio/virtio-snd.c +++ b/hw/audio/virtio-snd.c @@ -1240,7 +1240,7 @@ static void virtio_snd_pcm_in_cb(void *data, int available) { VirtIOSoundPCMStream *stream = data; VirtIOSoundPCMBuffer *buffer; - size_t size, max_size; + size_t size, max_size, to_read; WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) { while (!QSIMPLEQ_EMPTY(&stream->queue)) { @@ -1266,10 +1266,12 @@ static void virtio_snd_pcm_in_cb(void *data, int available) return_rx_buffer(stream, buffer); break; } + to_read = stream->params.period_bytes - buffer->size; + to_read = MIN(to_read, available); + to_read = MIN(to_read, max_size - buffer->size); size = AUD_read(stream->voice.in, - buffer->data + buffer->size, - MIN(available, (stream->params.period_bytes - - buffer->size))); + buffer->data + buffer->size, + to_read); if (!size) { available = 0; break; |