bhyve: buffer overflow in pci_vtcon_control_send

[khorben_defora.org]

Summary

This is a follow-up to the fix for HYP-19, addressing another condition where an overflow might still occur. (Spotted by jhb@, thanks!)

Reported by: Synacktiv
Security: HYP-19
Sponsored by: Alpha-Omega Project
Sponsored by: The FreeBSD Foundation

[markj]

usr.sbin/bhyve/pci_virtio_console.c

587

This check should come before the vq_getchain() call. The vq_relchain() call at the out label contains an instance of the overflowing expression.

[khorben_defora.org]

Moved the sanity check for len to the beginning of pci_vtcon_control_send().