diff options
| -rw-r--r-- | nbd/server.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/nbd/server.c b/nbd/server.c index 993ade30bb..b93cb88911 100644 --- a/nbd/server.c +++ b/nbd/server.c @@ -661,6 +661,12 @@ static int nbd_negotiate_options(NBDClient *client, uint16_t myflags, } length = be32_to_cpu(length); + if (length > NBD_MAX_BUFFER_SIZE) { + error_setg(errp, "len (%" PRIu32" ) is larger than max len (%u)", + length, NBD_MAX_BUFFER_SIZE); + return -EINVAL; + } + trace_nbd_negotiate_options_check_option(option, nbd_opt_lookup(option)); if (client->tlscreds && |