Re: [PATCH 2/5] migration/multifd: Validate next_packet_size in zlib/zstd recv

Peter Xu <[email protected]> writes:

> The zlib and zstd multifd compression backends read next_packet_size from
> the incoming migration stream and use it directly as the read length into a
> fixed-size buffer (MULTIFD_PACKET_SIZE * 2 = 1MB).  A malicious migration
> source can set next_packet_size bigger than allocated, causing a heap
> buffer overflow write on the destination.
>
> Add a check against zbuff_len before reading, matching what the qatzip
> backend already does.  Also replace the assert(in_size == 0) for empty
> packets with proper error reporting, since the value is wire-controlled,
> meanwhile assert() stops working with release builds.
>
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3737
> Reported-by: xlabai <[email protected]>
> Reported-by: Jules Denardou <[email protected]>
> Reported-by: Tristan Madani <[email protected]>
> Reported-by: david korczynski (@david1766)
> Reported-by: huntr bubble (@bubblehuntr)
> Cc: qemu-stable <[email protected]>
> Cc: Fabiano Rosas <[email protected]>
> Signed-off-by: Peter Xu <[email protected]>

Reviewed-by: Fabiano Rosas <[email protected]>