mirror of
https://github.com/qemu/qemu.git
synced 2026-07-08 17:46:10 +00:00
cb1e8c18df
The SB16 VMState loads in_index and out_data_len as raw INT32 values with no bounds validation. A crafted migration stream or VM snapshot can set these to values exceeding their respective buffer sizes (in2_data[10] and out_data[50]), causing heap OOB write in dsp_write() and heap OOB read in dsp_read(). Add bounds checks in sb16_post_load() to reject invalid values before they can be used as array indices. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3326 Reported-by: Jenny Guanni Qu <qguanni@gmail.com> Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com> Link: https://lore.kernel.org/r/20260318192918.65481-1-qguanni@gmail.com Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>