From f9abcb8d9ce772eb19c3b6fb396d814580c34ef0 Mon Sep 17 00:00:00 2001 From: Rob Bradford Date: Sat, 25 Apr 2026 22:32:00 +0100 Subject: [PATCH] virtio-devices: iommu: Use checked add for reply length The reply length was `hdr_len + size_of::()`, computed twice. Make it explicit via checked_add and reuse the result. Signed-off-by: Rob Bradford Assisted-by: Claude:claude-opus-4-7 --- virtio-devices/src/iommu.rs | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/virtio-devices/src/iommu.rs b/virtio-devices/src/iommu.rs index baa2a2421..c3ad4a72a 100644 --- a/virtio-devices/src/iommu.rs +++ b/virtio-devices/src/iommu.rs @@ -642,7 +642,10 @@ impl Request { return Err(Error::UnexpectedReadOnlyDescriptor); } - if status_desc.len() < hdr_len + size_of::() as u32 { + let reply_len = (hdr_len as usize) + .checked_add(size_of::()) + .ok_or(Error::BufferLengthTooSmall)?; + if (status_desc.len() as usize) < reply_len { return Err(Error::BufferLengthTooSmall); } @@ -662,7 +665,7 @@ impl Request { // Return the error if the result was not Ok(). result?; - Ok((hdr_len as usize) + size_of::()) + Ok(reply_len) } }