Commit 6728170d2d for qemu.org

commit 6728170d2d081d8aad46807bc5e64520650f2795
Author: Stefan Berger <stefanb@linux.vnet.ibm.com>
Date:   Fri Oct 2 10:25:09 2026 -0400

    tpm_emulator: Reject sending commands smaller than the request header

    Reject any TPM request from being sent to the TPM emulator that is shorter
    than the size of the request header.

    Fixes: f4ede81eed29 ("tpm: Added support for TPM emulator")
    Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Link: https://lore.kernel.org/qemu-devel/20261002142516.2063735-4-stefanb@linux.ibm.com
    Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

diff --git a/backends/tpm/tpm_emulator.c b/backends/tpm/tpm_emulator.c
index 9c95b4d878..0c9e32f36a 100644
--- a/backends/tpm/tpm_emulator.c
+++ b/backends/tpm/tpm_emulator.c
@@ -181,6 +181,11 @@ static int tpm_emulator_unix_tx_bufs(TPMEmulator *tpm_emu,
     uint32_t to_read;
     ssize_t ret;

+    if (in_len < sizeof(struct tpm_req_hdr)) {
+        error_setg(errp, "tpm-emulator: invalid request size %u", in_len);
+        return -1;
+    }
+
     if (selftest_done) {
         *selftest_done = false;
         is_selftest = tpm_util_is_selftest(in, in_len);