virtio-snd: check for invalid param shift operands
authorManos Pitsidianakis <manos.pitsidianakis@linaro.org>
Thu, 11 Jul 2024 07:38:49 +0000 (10:38 +0300)
committerMichael S. Tsirkin <mst@redhat.com>
Sun, 21 Jul 2024 18:43:02 +0000 (14:43 -0400)
commit9b6083465fb8311f2410615f8303a41f580a2a20
tree3468ded4b020ff1e57537aaa61c6df2a7c704325
parent98e77e3dd8dd6e7aa9a7dffa60f49c8c8a49d4e3
virtio-snd: check for invalid param shift operands

When setting the parameters of a PCM stream, we compute the bit flag
with the format and rate values as shift operand to check if they are
set in supported_formats and supported_rates.

If the guest provides a format/rate value which when shifting 1 results
in a value bigger than the number of bits in
supported_formats/supported_rates, we must report an error.

Previously, this ended up triggering the not reached assertions later
when converting to internal QEMU values.

Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2416
Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-Id: <virtio-snd-fuzz-2416-fix-v1-manos.pitsidianakis@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
hw/audio/virtio-snd.c