diff options
| author | Paolo Bonzini | 2018-10-23 00:58:43 +0200 |
|---|---|---|
| committer | Paolo Bonzini | 2018-11-06 21:35:05 +0100 |
| commit | 57dbb58d800f62b9e56d946660dba4e8dbd20204 (patch) | |
| tree | 6d71f68d85a5691af212dca8fc8c4c1c432c8e26 /hw/scsi/scsi-disk.c | |
| parent | scsi-generic: keep VPD page list sorted (diff) | |
| download | qemu-57dbb58d800f62b9e56d946660dba4e8dbd20204.tar.gz qemu-57dbb58d800f62b9e56d946660dba4e8dbd20204.tar.xz qemu-57dbb58d800f62b9e56d946660dba4e8dbd20204.zip | |
scsi-generic: avoid out-of-bounds access to VPD page list
A device can report an excessive number of VPD pages when asked for a
list; this can cause an out-of-bounds access to buf in
scsi_generic_set_vpd_bl_emulation. It should not happen, but
it is technically not incorrect so handle it: do not check any byte
past the allocation length that was sent to the INQUIRY command.
Reported-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw/scsi/scsi-disk.c')
0 files changed, 0 insertions, 0 deletions