On Wed, Oct 14, 2015 at 10:52:15PM +0800, Xiao Guangrong wrote: > On 10/14/2015 05:41 PM, Stefan Hajnoczi wrote: > >On Sun, Oct 11, 2015 at 11:52:59AM +0800, Xiao Guangrong wrote: > >>+ out->len = sizeof(out->status); > > > >out->len is uint16_t, it needs cpu_to_le16(). There may be other > >instances in this patch series. > > > > out->len is internally used only which is invisible to guest OS, i,e, > we write this value and read this value by ourself. I think it is > okay.
'out' points to guest memory. Guest memory is untrusted so QEMU cannot stash values there - an evil guest could modify them. Please put the len variable on the QEMU stack or heap where the guest cannot access it.
