Li Qiang 4787501893 vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546) ... If 'virgl_cmd_get_capset' set 'max_size' to 0, the 'virgl_renderer_fill_caps' will write the data after the 'resp'. This patch avoid this by checking the returned 'max_size'. virtio-gpu fix: abd7f08b23 ("display: virtio-gpu-3d: check virgl capabilities max_size") Fixes: CVE-2021-3546 Reported-by: Li Qiang <liq3ea@163.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-8-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 9f22893adc) Signed-off-by: Michael Roth <michael.roth@amd.com>		2021-10-17 20:26:37 -05:00
..
elf2dmp	elf2dmp: Rename PAGE_SIZE to ELF2DMP_PAGE_SIZE	2021-01-20 10:46:54 +01:00
gitdm	contrib/gitdm: Add more individual contributors	2020-10-27 09:53:47 +00:00
ivshmem-client	contrib: ivshmem client and server build fix for SunOS.	2021-03-20 06:33:17 +01:00
ivshmem-server	contrib: ivshmem client and server build fix for SunOS.	2021-03-20 06:33:17 +01:00
plugins	plugins: Expose physical addresses instead of device offsets	2021-03-17 07:17:46 +00:00
rdmacm-mux	contrib/rdmacm-mux: Fix error condition in hash_tbl_search_fd_by_ifid()	2020-12-18 20:15:42 +02:00
systemd	contrib: add systemd unit files	2017-12-20 22:29:26 +01:00
vhost-user-blk	contrib/vhost-user-blk: avoid g_return_val_if() input validation	2020-12-09 13:04:17 -05:00
vhost-user-gpu	vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546)	2021-10-17 20:26:37 -05:00
vhost-user-input	Clean up includes	2020-12-10 17:16:44 +01:00
vhost-user-scsi	libiscsi: convert to meson	2021-01-02 21:03:37 +01:00