[PATCH v3 2/7] hw/char/virtio-serial-bus: validate nr_active_ports from migration stream

The migration restore path reads nr_active_ports from the incoming
stream and passes it directly to fetch_active_ports_list(), which
uses it to size a heap allocation. A crafted migration stream can set
this field to a very large value, causing QEMU to attempt a
multi-gigabyte allocation and abort.

Fix this by checking nr_active_ports against the configured
max_virtserial_ports before calling fetch_active_ports_list().

Cc: [email protected]
Fixes: 6663a1956eb6 ("virtio-serial-bus: Maintain guest and host port open/close state")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3801
Signed-off-by: Laurent Vivier <[email protected]>
Reviewed-by: Daniel P. Berrangé <[email protected]>
Reviewed-by: Thomas Huth <[email protected]>
Acked-by: Michael S. Tsirkin <[email protected]>
---

Notes:
    v2: add error_setg() call with descriptive error message

 hw/char/virtio-serial-bus.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index 87bfe51b6e93..4a5507e2f755 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -803,6 +803,12 @@ static int virtio_serial_load_device(VirtIODevice *vdev, QEMUFile *f,
 
     qemu_get_be32s(f, &nr_active_ports);
 
+    if (nr_active_ports > max_nr_ports) {
+        error_setg(errp, "Invalid number of active ports %u > %u", nr_active_ports,
+                   max_nr_ports);
+        return -EINVAL;
+    }
+
     if (nr_active_ports) {
         Error *local_err = NULL;
 
-- 
2.54.0