diff --git a/nbd/server.c b/nbd/server.c index a81801e3bc8ef33f034edde13e784bffe16dd433..92c0fdd03b651872fda5f5c0a52227c1b77996d1 100644 --- a/nbd/server.c +++ b/nbd/server.c @@ -386,6 +386,10 @@ static int nbd_negotiate_handle_info(NBDClient *client, uint32_t length, msg = "name length is incorrect"; goto invalid; } + if (namelen >= sizeof(name)) { + msg = "name too long for qemu"; + goto invalid; + } if (nbd_read(client->ioc, name, namelen, errp) < 0) { return -EIO; }