Li Qiang 9f22893adc vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546) ... If 'virgl_cmd_get_capset' set 'max_size' to 0, the 'virgl_renderer_fill_caps' will write the data after the 'resp'. This patch avoid this by checking the returned 'max_size'. virtio-gpu fix: abd7f08b23 ("display: virtio-gpu-3d: check virgl capabilities max_size") Fixes: CVE-2021-3546 Reported-by: Li Qiang <liq3ea@163.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-8-liq3ea@163.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>		2021-05-27 11:55:59 +02:00
..
50-qemu-gpu.json.in	vhost-user-gpu: Drop trailing json comma	2019-12-20 06:56:37 +01:00
meson.build	vhost-user-gpu: glFlush before notifying clients	2021-03-26 06:37:03 +01:00
vhost-user-gpu.c	vhost-user-gpu: fix memory leak while calling 'vg_resource_unref' (CVE-2021-3544)	2021-05-27 11:55:59 +02:00
virgl.c	vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546)	2021-05-27 11:55:59 +02:00
virgl.h	Clean up a header guard symbols (again)	2019-06-12 13:20:21 +02:00
vugbm.c	vhost-user-gpu: fix vugbm_device_init fallback	2021-03-26 06:37:03 +01:00
vugbm.h	vhost-user-gpu: fix vugbm_device_init fallback	2021-03-26 06:37:03 +01:00
vugpu.h	vhost-user-gpu: use an extandable state enum for commands	2021-02-04 15:58:54 +01:00