From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 22 Oct 2018 22:58:43 +0000 (+0200)
Subject: scsi-generic: avoid out-of-bounds access to VPD page list
X-Git-Tag: qemu-xen-4.13.0-rc1~569^2~4
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=57dbb58d800f62b9e56d946660dba4e8dbd20204;p=qemu-xen.git

scsi-generic: avoid out-of-bounds access to VPD page list

A device can report an excessive number of VPD pages when asked for a
list; this can cause an out-of-bounds access to buf in
scsi_generic_set_vpd_bl_emulation.  It should not happen, but
it is technically not incorrect so handle it: do not check any byte
past the allocation length that was sent to the INQUIRY command.

Reported-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---

diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
index aebb7cdd82..c5497bbea8 100644
--- a/hw/scsi/scsi-generic.c
+++ b/hw/scsi/scsi-generic.c
@@ -538,7 +538,7 @@ static void scsi_generic_set_vpd_bl_emulation(SCSIDevice *s)
     }
 
     page_len = buf[3];
-    for (i = 4; i < page_len + 4; i++) {
+    for (i = 4; i < MIN(sizeof(buf), page_len + 4); i++) {
         if (buf[i] == 0xb0) {
             s->needs_vpd_bl_emulation = false;
             return;