[PULL 08/13] vfio-user: vfio_user_get_region_info: prevent excessive malloc

["Cédric Le Goater" <clg@redhat.com>]

From: Thanos Makatos <thanos.makatos@nutanix.com>

If the vfio-user server responds with a value larger than max_xfer_size
vfio_device_get_region_info() blindly uses it in the next loop in
g_realloc. An value larger than max_xfer_size is anyway rejected by the
check at the beginning of vfio_user_get_region_info(), however that only
happens _after_ the g_realloc, and if that value is excessively large it
can cause g_realloc to fail, so check it here.

Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com>
Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260721122643.30985-5-thanos.makatos@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/device.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index 3d12e8b2a20eb96fb1a8a944070d13bf0e049b67..008e5cf6877c84c3d0cf33f25a6ac9a4cf231e06 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -170,6 +170,16 @@ static int vfio_user_get_region_info(VFIOUserProxy *proxy,
         return -EINVAL;
     }
 
+    /*
+     * The server can respond with a larger argsz in the reply to request a
+     * larger buffer on the next iteration via vfio_device_get_region_info().
+     * Reject values that would trigger an oversized realloc.
+     */
+    if (msgp->argsz > proxy->max_xfer_size) {
+        error_printf("vfio_user_get_region_info reply argsz too large\n");
+        return -E2BIG;
+    }
+
     memcpy(info, &msgp->argsz, info->argsz);
 
     /*
-- 
2.55.0