Blame SOURCES/kvm-scsi-generic-avoid-out-of-bounds-access-to-VPD-page-.patch

26ba25
From bc4b0e1c80d9f9e2acf44ef99b7771f96be90791 Mon Sep 17 00:00:00 2001
26ba25
From: Paolo Bonzini <pbonzini@redhat.com>
26ba25
Date: Thu, 20 Dec 2018 12:31:01 +0000
26ba25
Subject: [PATCH 6/8] scsi-generic: avoid out-of-bounds access to VPD page list
26ba25
MIME-Version: 1.0
26ba25
Content-Type: text/plain; charset=UTF-8
26ba25
Content-Transfer-Encoding: 8bit
26ba25
26ba25
RH-Author: Paolo Bonzini <pbonzini@redhat.com>
26ba25
Message-id: <20181220123103.29579-7-pbonzini@redhat.com>
26ba25
Patchwork-id: 83715
26ba25
O-Subject: [PATCH 6/8] scsi-generic: avoid out-of-bounds access to VPD page list
26ba25
Bugzilla: 1639957
26ba25
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
26ba25
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
26ba25
RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
26ba25
RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
26ba25
26ba25
A device can report an excessive number of VPD pages when asked for a
26ba25
list; this can cause an out-of-bounds access to buf in
26ba25
scsi_generic_set_vpd_bl_emulation.  It should not happen, but
26ba25
it is technically not incorrect so handle it: do not check any byte
26ba25
past the allocation length that was sent to the INQUIRY command.
26ba25
26ba25
Reported-by: Max Reitz <mreitz@redhat.com>
26ba25
Reviewed-by: Max Reitz <mreitz@redhat.com>
26ba25
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
26ba25
(cherry picked from commit 57dbb58d800f62b9e56d946660dba4e8dbd20204)
26ba25
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
26ba25
---
26ba25
 hw/scsi/scsi-generic.c | 2 +-
26ba25
 1 file changed, 1 insertion(+), 1 deletion(-)
26ba25
26ba25
diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
26ba25
index 98c6a34..6d6db69 100644
26ba25
--- a/hw/scsi/scsi-generic.c
26ba25
+++ b/hw/scsi/scsi-generic.c
26ba25
@@ -539,7 +539,7 @@ static void scsi_generic_set_vpd_bl_emulation(SCSIDevice *s)
26ba25
     }
26ba25
 
26ba25
     page_len = buf[3];
26ba25
-    for (i = 4; i < page_len + 4; i++) {
26ba25
+    for (i = 4; i < MIN(sizeof(buf), page_len + 4); i++) {
26ba25
         if (buf[i] == 0xb0) {
26ba25
             s->needs_vpd_bl_emulation = false;
26ba25
             return;
26ba25
-- 
26ba25
1.8.3.1
26ba25