)]}'
{
  "commit": "7edbbff5ee85dd28699c5acd6ea2f2c2e41c37d2",
  "tree": "bd509ff231c12768a1633865d8fdd6c56826f7f3",
  "parents": [
    "802671c37a6ab4de116866883841bcc8b2318124"
  ],
  "author": {
    "name": "Jonathan Cameron",
    "email": "Jonathan.Cameron@huawei.com",
    "time": "Fri Nov 01 13:39:08 2024 +0000"
  },
  "committer": {
    "name": "Michael S. Tsirkin",
    "email": "mst@redhat.com",
    "time": "Mon Nov 04 16:03:25 2024 -0500"
  },
  "message": "hw/cxl: Check size of input data to dynamic capacity mailbox commands\n\ncxl_cmd_dcd_release_dyn_cap() and cmd_dcd_add_dyn_cap_rsp() are missing\ninput message size checks.  These must be done in the individual\ncommands when the command has a variable length input payload.\n\nA buggy or malicious guest might send undersized messages via the mailbox.\nAs that size is used to take a copy of the mailbox content, each command\nmust check there is sufficient data. In this case the first check is that\nthere is enough data to read how many extents there are, and the second\nthat there is enough for those elements to be accessed.\n\nReported-by: Esifiel \u003cesifiel@gmail.com\u003e\nSigned-off-by: Jonathan Cameron \u003cJonathan.Cameron@huawei.com\u003e\nMessage-Id: \u003c20241101133917.27634-2-Jonathan.Cameron@huawei.com\u003e\nReviewed-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "97cb8bbcec42c87d49b323d7f4de780fe475e601",
      "old_mode": 33188,
      "old_path": "hw/cxl/cxl-mailbox-utils.c",
      "new_id": "17924410dde7a2f6de0e8c6930e371bbc066ff77",
      "new_mode": 33188,
      "new_path": "hw/cxl/cxl-mailbox-utils.c"
    }
  ]
}