mirror of
https://github.com/cloud-hypervisor/cloud-hypervisor.git
synced 2026-08-05 02:19:16 +00:00
VfioUserDmaMapping::map is reached from the virtio-iommu MAP handler with (iova, gpa, size) all guest-controlled. Validate the length of the region fits, not just the start. Before this change the vfio-user on the other end could get a size that spans past the end of its backing storage. Signed-off-by: Dylan Reid <dgreid@fb.com>