| commit | f50ab86a2620bd7e8507af865b164655ee921661 | |
| author | Prasad J Pandit <pjp@fedoraproject.org> | |
| Wed, 13 May 2020 19:25:38 +0000 (14 00:55 +0530) | ||
| committer | Paolo Bonzini <pbonzini@redhat.com> | |
| Wed, 10 Jun 2020 16:10:12 +0000 (10 12:10 -0400) | ||
| tree | 26df3019b59b085903ae1e860d633057f67dfd84 | treesnapshot (tar.gz zip) |
| parent | 2a6931425890a9a2822e62f60724a9edbb93ba10 | commitdiff |
megasas: use unsigned type for reply_queue_head and check index
A guest user may set 'reply_queue_head' field of MegasasState to
a negative value. Later in 'megasas_lookup_frame' it is used to
index into s->frames[] array. Use unsigned type to avoid OOB
access issue.
Also check that 'index' value stays within s->frames[] bounds
through the while() loop in 'megasas_lookup_frame' to avoid OOB
access.
Reported-by: Ren Ding <rding@gatech.edu>
Reported-by: Hanqing Zhao <hanqing@gatech.edu>
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Acked-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20200513192540.1583887-2-ppandit@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
A guest user may set 'reply_queue_head' field of MegasasState to
a negative value. Later in 'megasas_lookup_frame' it is used to
index into s->frames[] array. Use unsigned type to avoid OOB
access issue.
Also check that 'index' value stays within s->frames[] bounds
through the while() loop in 'megasas_lookup_frame' to avoid OOB
access.
Reported-by: Ren Ding <rding@gatech.edu>
Reported-by: Hanqing Zhao <hanqing@gatech.edu>
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Acked-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20200513192540.1583887-2-ppandit@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| hw/scsi/megasas.c | diffblobblamehistory |