)]}'
{
  "commit": "98e77e3dd8dd6e7aa9a7dffa60f49c8c8a49d4e3",
  "tree": "6c5b87b0650df909b124689f64b8dfbe2a655fe8",
  "parents": [
    "e3f15732c479e6c4baa56af65f52d99fbfb5c417"
  ],
  "author": {
    "name": "Manos Pitsidianakis",
    "email": "manos.pitsidianakis@linaro.org",
    "time": "Mon Jul 08 10:09:49 2024 +0300"
  },
  "committer": {
    "name": "Michael S. Tsirkin",
    "email": "mst@redhat.com",
    "time": "Sun Jul 21 14:43:02 2024 -0400"
  },
  "message": "virtio-snd: add max size bounds check in input cb\n\nWhen reading input audio in the virtio-snd input callback,\nvirtio_snd_pcm_in_cb(), we do not check whether the iov can actually fit\nthe data buffer. This is because we use the buffer-\u003esize field as a\ntotal-so-far accumulator instead of byte-size-left like in TX buffers.\n\nThis triggers an out of bounds write if the size of the virtio queue\nelement is equal to virtio_snd_pcm_status, which makes the available\nspace for audio data zero. This commit adds a check for reaching the\nmaximum buffer size before attempting any writes.\n\nReported-by: Zheyu Ma \u003czheyuma97@gmail.com\u003e\nResolves: https://gitlab.com/qemu-project/qemu/-/issues/2427\nSigned-off-by: Manos Pitsidianakis \u003cmanos.pitsidianakis@linaro.org\u003e\nMessage-Id: \u003cvirtio-snd-fuzz-2427-fix-v1-manos.pitsidianakis@linaro.org\u003e\nReviewed-by: Philippe Mathieu-Daudé \u003cphilmd@linaro.org\u003e\nReviewed-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5993f4f04076ff768498bcb1d04c75a34e224f7d",
      "old_mode": 33188,
      "old_path": "hw/audio/virtio-snd.c",
      "new_id": "e6432ac959a810f67082f2e351510a2f7c82347c",
      "new_mode": 33188,
      "new_path": "hw/audio/virtio-snd.c"
    }
  ]
}