fix: guard GFD PCI vendor capability parsing against bad lengths

Validate capability header and body bounds before slicing config space
so malformed PCI data does not panic gpu-feature-discovery.

Signed-off-by: amarkdotdev <amarkdotdev@users.noreply.github.com>

Author: amarkdotdev

internal/vgpu/pciutil.go

@@ -124,6 +124,11 @@ func (d *PCIDevice) GetVendorSpecificCapability() ([]byte, error) {
 	var visited [256]byte
 	pos := GetByte(d.Config, PciCapabilityList)
 	for pos != 0 {
+		capHeaderEnd := int(pos) + int(PciCapabilityLength) + 1
+		if capHeaderEnd > len(d.Config) {
+			break
+		}
+
 		id := GetByte(d.Config, pos+PciCapabilityListID)
 		next := GetByte(d.Config, pos+PciCapabilityListNext)
 		length := GetByte(d.Config, pos+PciCapabilityLength)
@@ -137,7 +142,11 @@ func (d *PCIDevice) GetVendorSpecificCapability() ([]byte, error) {
 			break
 		}
 		if id == PciCapabilityVendorSpecificID {
-			capability := d.Config[pos+PciCapabilityListID : pos+PciCapabilityListID+length]
+			capEnd := int(pos) + int(PciCapabilityListID) + int(length)
+			if capEnd > len(d.Config) {
+				break
+			}
+			capability := d.Config[pos+PciCapabilityListID : capEnd]
 			return capability, nil
 		}
 

internal/vgpu/pciutil_test.go

@@ -23,6 +23,24 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestGetVendorSpecificCapabilityMalformedLength(t *testing.T) {
+	config := make([]byte, 256)
+	config[PciStatusByte] = PciStatusCapabilityList
+	config[PciCapabilityList] = 224
+
+	config[224+PciCapabilityListID] = PciCapabilityVendorSpecificID
+	config[224+PciCapabilityLength] = 100
+
+	device := &PCIDevice{
+		Address: "malformed",
+		Config:  config,
+	}
+
+	capability, err := device.GetVendorSpecificCapability()
+	require.NoError(t, err)
+	require.Nil(t, capability)
+}
+
 func TestGetVendorSpecificCapability(t *testing.T) {
 	devices, _ := NewMockNvidiaPCI().Devices()
 	for _, device := range devices {