A guest-triggerable buffer overflow was reported in libvhost-user.
When an indirect descriptor table crosses a memory region boundary,
virtqueue_read_indirect_desc() falls back to a chunked copy, but
the destination pointer is a struct vring_desc pointer advanced by
a byte count, so it overflows the buffer.

libvduse has vduse_queue_read_indirect_desc() which was inspired by
the libvhost-user counterpart, so it has the same issue.

Stefano Garzarella (2):
  libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc()
  libvduse: fix buffer overflow in vduse_queue_read_indirect_desc()

 subprojects/libvduse/libvduse.c           | 7 ++++---
 subprojects/libvhost-user/libvhost-user.c | 7 ++++---
 2 files changed, 8 insertions(+), 6 deletions(-)

-- 
2.53.0