[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v2] scsi: esp: check length before dma read
From: |
P J P |
Subject: |
[Qemu-devel] [PATCH v2] scsi: esp: check length before dma read |
Date: |
Wed, 15 Jun 2016 17:38:58 +0530 |
From: Prasad J Pandit <address@hidden>
While doing DMA read into ESP command buffer 's->cmdbuf', the
length parameter could exceed the buffer size. Add check to avoid
OOB access.
Reported-by: Li Qiang <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
---
hw/scsi/esp.c | 3 +++
1 file changed, 3 insertions(+)
Update:
- corrected Li Qiang's email id above.
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 4b94bbc..dfea571 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -249,6 +249,9 @@ static void esp_do_dma(ESPState *s)
len = s->dma_left;
if (s->do_cmd) {
trace_esp_do_dma(s->cmdlen, len);
+ if (s->cmdlen + len >= sizeof(s->cmdbuf)) {
+ return;
+ }
s->dma_memory_read(s->dma_opaque, &s->cmdbuf[s->cmdlen], len);
s->ti_size = 0;
s->cmdlen = 0;
--
2.5.5
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Qemu-devel] [PATCH v2] scsi: esp: check length before dma read,
P J P <=