diff --git a/virtio-devices/src/watchdog.rs b/virtio-devices/src/watchdog.rs index 38fa5b6de..500e9e816 100644 --- a/virtio-devices/src/watchdog.rs +++ b/virtio-devices/src/watchdog.rs @@ -22,6 +22,7 @@ use thiserror::Error; use virtio_queue::{Queue, QueueT}; use vm_memory::{Bytes, GuestAddressSpace, GuestMemoryAtomic}; use vm_migration::{Migratable, MigratableError, Pausable, Snapshot, Snapshottable, Transportable}; +use vm_virtio::checked_descriptor::DescriptorChainExt; use vmm_sys_util::eventfd::EventFd; use super::{ @@ -81,9 +82,13 @@ impl WatchdogEpollHandler { let queue = &mut self.queue; let mut used_descs = false; while let Some(mut desc_chain) = queue.pop_descriptor_chain(self.mem.memory()) { - let desc = desc_chain.next().ok_or(Error::DescriptorChainTooShort)?; + let mut descs = desc_chain.checked_iter(None); + let desc = descs + .next() + .ok_or(Error::DescriptorChainTooShort)? + .map_err(|_| Error::InvalidDescriptor)?; - if !(desc.is_write_only() && desc.len() > 0) { + if !desc.is_write_only() || desc.is_empty() { return Err(Error::InvalidDescriptor); }