fix: the slirp_input() call at net/slirp in slirp.c

[orbisai0security]

Summary

Fix critical severity security issue in net/slirp.c.

Vulnerability

Field	Value
ID	V-007
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-007
File	net/slirp.c:137

Description: The slirp_input() call at net/slirp.c:137 passes a network packet buffer and its size parameter directly from the guest network receive path without validating that 'size' does not exceed the actual allocated buffer length. The SLIRP user-mode networking stack processes all guest-generated network packets through this path, making it directly reachable from a guest VM. A crafted packet with a manipulated size field can cause SLIRP to read or write beyond the buffer boundary in the QEMU host process.

Changes

• net/slirp.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[github-actions]

Thank you for your interest in the QEMU project.

This repository is a read-only mirror of the project's repostories hosted
on https://gitlab.com/qemu-project/qemu.git.
The project does not process merge requests filed on GitHub.

QEMU welcomes contributions of code (either fixing bugs or adding new
functionality). However, we get a lot of patches, and so we have some
guidelines about contributing on the project website:
https://www.qemu.org/contribute/