)]}'
{
  "commit": "61679d7dcfa2dffc8fb115aa19b09e0e7cf5ea5c",
  "tree": "addcf3659bf0cb13cb52cd47dddca2e7f636eedd",
  "parents": [
    "34238f078a04f24b91199249b83846ab082b4e05"
  ],
  "author": {
    "name": "Manos Pitsidianakis",
    "email": "manos.pitsidianakis@linaro.org",
    "time": "Fri Feb 20 11:40:14 2026 +0200"
  },
  "committer": {
    "name": "Michael S. Tsirkin",
    "email": "mst@redhat.com",
    "time": "Fri Feb 20 13:04:45 2026 -0500"
  },
  "message": "virtio-snd: handle 5.14.6.2 for PCM_INFO properly\n\nThe section 5.14.6.2 of the VIRTIO spec says:\n\n  5.14.6.2 Driver Requirements: Item Information Request\n\n  - The driver MUST NOT set start_id and count such that start_id +\n    count is greater than the total number of particular items that is\n    indicated in the device configuration space.\n\n  - The driver MUST provide a buffer of sizeof(struct virtio_snd_hdr) +\n    count * size bytes for the response.\n\nWhile we performed some check for the second requirement, it failed to\ncheck for integer overflow.\n\nAdd also a check for the first requirement, which should limit exposure\nto any overflow, since realistically the number of streams will be low\nenough in value such that overflow is improbable.\n\nCc: qemu-stable@nongnu.org\nReported-by: 罗铭源 \u003cmyluo24@m.fudan.edu.cn\u003e\nSigned-off-by: Manos Pitsidianakis \u003cmanos.pitsidianakis@linaro.org\u003e\nReviewed-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nMessage-Id: \u003c20260220-virtio-snd-series-v1-3-207c4f7200a2@linaro.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "232179a04ad5b94344116328ac1755756ffb47f7",
      "old_mode": 33188,
      "old_path": "hw/audio/virtio-snd.c",
      "new_id": "ae8bfbca431046dfa240f5e19559aab629147b65",
      "new_mode": 33188,
      "new_path": "hw/audio/virtio-snd.c"
    }
  ]
}