mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
287c181ae4
qemu/hw/scsi
History
Prasad J Pandit 926cde5f3e scsi: esp: make cmdbuf big enough for maximum CDB size 
While doing DMA read into ESP command buffer 's->cmdbuf', it could
write past the 's->cmdbuf' area, if it was transferring more than 16
bytes.  Increase the command buffer size to 32, which is maximum when
's->do_cmd' is set, and add a check on 'len' to avoid OOB access.

Reported-by: Li Qiang <liqiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-16 18:39:05 +02:00
..
esp-pci.c include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
esp.c scsi: esp: make cmdbuf big enough for maximum CDB size 2016-06-16 18:39:05 +02:00
lsi53c895a.c hw/scsi: Clean up includes 2016-01-29 15:07:24 +00:00
Makefile.objs hw: Add support for LSI SAS1068 (mptsas) device 2016-02-09 15:45:26 +01:00
megasas.c scsi: megasas: null terminate bios version buffer 2016-06-07 14:09:05 +02:00
mfi.h megasas: add MegaRAID SAS 2108 emulation 2014-10-31 11:29:00 +01:00
mpi.h hw: Add support for LSI SAS1068 (mptsas) device 2016-02-09 15:45:26 +01:00
mptconfig.c mptsas: add missing va_end 2016-02-16 16:41:17 +01:00
mptendian.c hw: Add support for LSI SAS1068 (mptsas) device 2016-02-09 15:45:26 +01:00
mptsas.c scsi: mptsas: infinite loop while fetching requests 2016-05-29 09:11:10 +02:00
mptsas.h hw: Add support for LSI SAS1068 (mptsas) device 2016-02-09 15:45:26 +01:00
scsi-bus.c util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
scsi-disk.c scsi-disk: Use (unsigned long) typecasts when using "%lu" format string 2016-06-16 18:39:04 +02:00
scsi-generic.c scsi-generic: Merge block max xfer len in INQUIRY response 2016-05-29 09:11:12 +02:00
spapr_vscsi.c Fix some typos found by codespell 2016-05-18 15:04:27 +03:00
srp.h spapr-vscsi: add task management 2013-09-12 08:46:21 +02:00
vhost-scsi.c util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
viosrp.h
virtio-scsi-dataplane.c virtio: merge virtio_queue_aio_set_host_notifier_handler with virtio_queue_set_aio 2016-04-07 19:57:33 +03:00
virtio-scsi.c virtio: drop duplicate virtio_queue_get_id() function 2016-06-07 14:40:51 +01:00
vmw_pvscsi.c scsi: pvscsi: check command descriptor ring buffer size (CVE-2016-4952) 2016-05-29 09:11:10 +02:00
vmw_pvscsi.h