On Fri, Nov 01, 2024 at 01:39:14PM +0000, Jonathan Cameron wrote:
> If len_in is less than the minimum spec allowed value, then return
> CXL_MBOX_INVALID_PAYLOAD_LENGTH
>
> Reported-by: Esifiel <esif...@gmail.com>
> Signed-off-by: Jonathan Cameron <jonathan.came...@huawei.com>
> ---
> hw/cxl/cxl-mailbox-utils.c | 3 +++
> 1 file changed, 3 insertions(+)
>
Reviewed-by: Fan Ni <fan...@samsung.com>
> diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
> index 5e571955b6..a40d81219c 100644
> --- a/hw/cxl/cxl-mailbox-utils.c
> +++ b/hw/cxl/cxl-mailbox-utils.c
> @@ -151,6 +151,9 @@ static CXLRetCode cmd_tunnel_management_cmd(const struct
> cxl_cmd *cmd,
> in = (void *)payload_in;
> out = (void *)payload_out;
>
> + if (len_in < sizeof(*in)) {
> + return CXL_MBOX_INVALID_PAYLOAD_LENGTH;
> + }
> /* Enough room for minimum sized message - no payload */
> if (in->size < sizeof(in->ccimessage)) {
> return CXL_MBOX_INVALID_PAYLOAD_LENGTH;
> --
> 2.43.0
>
--
Fan Ni
