From bc4b0e1c80d9f9e2acf44ef99b7771f96be90791 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Thu, 20 Dec 2018 12:31:01 +0000 Subject: [PATCH 6/8] scsi-generic: avoid out-of-bounds access to VPD page list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RH-Author: Paolo Bonzini Message-id: <20181220123103.29579-7-pbonzini@redhat.com> Patchwork-id: 83715 O-Subject: [PATCH 6/8] scsi-generic: avoid out-of-bounds access to VPD page list Bugzilla: 1639957 RH-Acked-by: Stefan Hajnoczi RH-Acked-by: Philippe Mathieu-Daudé RH-Acked-by: Kevin Wolf RH-Acked-by: Laurent Vivier A device can report an excessive number of VPD pages when asked for a list; this can cause an out-of-bounds access to buf in scsi_generic_set_vpd_bl_emulation. It should not happen, but it is technically not incorrect so handle it: do not check any byte past the allocation length that was sent to the INQUIRY command. Reported-by: Max Reitz Reviewed-by: Max Reitz Signed-off-by: Paolo Bonzini (cherry picked from commit 57dbb58d800f62b9e56d946660dba4e8dbd20204) Signed-off-by: Danilo C. L. de Paula --- hw/scsi/scsi-generic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c index 98c6a34..6d6db69 100644 --- a/hw/scsi/scsi-generic.c +++ b/hw/scsi/scsi-generic.c @@ -539,7 +539,7 @@ static void scsi_generic_set_vpd_bl_emulation(SCSIDevice *s) } page_len = buf[3]; - for (i = 4; i < page_len + 4; i++) { + for (i = 4; i < MIN(sizeof(buf), page_len + 4); i++) { if (buf[i] == 0xb0) { s->needs_vpd_bl_emulation = false; return; -- 1.8.3.1