falso
/
qemu-irix
mirror of https://github.com/n64decomp/qemu-irix.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

esp: check command buffer length before write(CVE-2016-4439) 

The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte
FIFO buffer. It is used to handle command and data transfer. While
writing to this command buffer 's->cmdbuf[TI_BUFSZ=16]', a check
was missing to validate input length. Add check to avoid OOB write
access.

Fixes CVE-2016-4439.

Reported-by: Li Qiang <liqiang6-s@360.cn>
Cc: qemu-stable@nongnu.org
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <1463654371-11169-2-git-send-email-ppandit@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit c98c6c105f)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
This commit is contained in:
Prasad J Pandit 2016-05-19 16:09:30 +05:30 committed by Michael Roth
parent 2522f0fcd1
commit 0a5e3685ea
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hw/scsi/esp.c
View File

@ -448,7 +448,11 @@ void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
break; break;
case ESP_FIFO: case ESP_FIFO:
if (s->do_cmd) { if (s->do_cmd) {
s->cmdbuf[s->cmdlen++] = val & 0xff; if (s->cmdlen < TI_BUFSZ) {
s->cmdbuf[s->cmdlen++] = val & 0xff;
} else {
trace_esp_error_fifo_overrun();
}
} else if (s->ti_size == TI_BUFSZ - 1) { } else if (s->ti_size == TI_BUFSZ - 1) {
trace_esp_error_fifo_overrun(); trace_esp_error_fifo_overrun();
} else { } else {