Skip to content

Commit e11b229

Browse files
committed
Fix heap buffer overflow with -x option
The opt_virtio_blk_img array can be overflowed if more than VBLK_DEV_MAX virtio-blk devices are specified using the -x option, as opt_virtio_blk_idx is incremented without bounds checking. Add a check to ensure that opt_virtio_blk_idx does not exceed VBLK_DEV_MAX. If the limit is reached, log an error and exit.
1 parent 68fa45a commit e11b229

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

src/main.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,11 @@ static bool parse_args(int argc, char **args)
131131
emu_argc++;
132132
break;
133133
case 'x':
134+
if (opt_virtio_blk_idx >= VBLK_DEV_MAX) {
135+
rv_log_error("Too many virtio-blk devices. Maximum is %d.\n",
136+
VBLK_DEV_MAX);
137+
return false;
138+
}
134139
if (!strncmp("vblk:", optarg, 5))
135140
opt_virtio_blk_img[opt_virtio_blk_idx++] =
136141
optarg + 5; /* strlen("vblk:") */

0 commit comments

Comments
 (0)