[PULL 10/13] vfio-user: vfio_user_device_io_device_feature: prevent buffer overflow

["Cédric Le Goater" <clg@redhat.com>]

From: Thanos Makatos <thanos.makatos@nutanix.com>

This isn't in practise a problem since feature->argsz is not
externally provided, it's a good hardening step nonetheless.

Fixes: e2358af5838d ("vfio-user: support VFIO_USER_DEVICE_FEATURE")
Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260721122643.30985-7-thanos.makatos@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/device.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index 3d0dbe840649b7b678b79afd3dbc7f9caaeb947b..353fa5ee21e34a88bcd0eff9de40d9757387a616 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -79,9 +79,14 @@ vfio_user_device_io_device_feature(VFIODevice *vbasedev,
                                    struct vfio_device_feature *feature)
 {
     g_autofree VFIOUserDeviceFeature *msgp = NULL;
-    int size = sizeof(VFIOUserHdr) + feature->argsz;
     VFIOUserProxy *proxy = vbasedev->proxy;
     Error *local_err = NULL;
+    int size;
+
+    if (__builtin_add_overflow(feature->argsz, sizeof(VFIOUserHdr), &size)) {
+        error_printf("vfio_user_device_io_device_feature argsz too large\n");
+        return -E2BIG;
+    }
 
     msgp = g_malloc0(size);
 
-- 
2.55.0