[PULL 07/13] vfio-user: vfio_user_get_region_info: reject unreasonably short struct

["Cédric Le Goater" <clg@redhat.com>]

From: Thanos Makatos <thanos.makatos@nutanix.com>

While this isn't technically a bug, it's highly unlikely that the
server wouldn't be writing an entire struct.

Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com>
Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260721122643.30985-4-thanos.makatos@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/device.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index 8350bb2c018504dbca50a4e9afbfc6be251f5b2a..3d12e8b2a20eb96fb1a8a944070d13bf0e049b67 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -165,6 +165,11 @@ static int vfio_user_get_region_info(VFIOUserProxy *proxy,
     }
     trace_vfio_user_get_region_info(msgp->index, msgp->flags, msgp->size);
 
+    if (msgp->argsz < sizeof(*info)) {
+        error_printf("vfio_user_get_region_info reply argsz too small\n");
+        return -EINVAL;
+    }
+
     memcpy(info, &msgp->argsz, info->argsz);
 
     /*
-- 
2.55.0