Prasad J Pandit 27fa5e735a scsi: esp: make cmdbuf big enough for maximum CDB size ... While doing DMA read into ESP command buffer 's->cmdbuf', it could write past the 's->cmdbuf' area, if it was transferring more than 16 bytes. Increase the command buffer size to 32, which is maximum when 's->do_cmd' is set, and add a check on 'len' to avoid OOB access. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 926cde5f3e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>		2016-08-09 14:31:04 -05:00
..
acpi	acpi: Add missing GCC_FMT_ATTR	2016-04-07 19:57:33 +03:00
arm	bcm2835_dma: add emulation of Raspberry Pi DMA controller	2016-03-16 17:42:18 +00:00
audio	…
block	fdc: add function to determine drive chs limits	2016-03-11 14:55:15 +02:00
char	Use scripts/clean-includes to drop redundant qemu/typedefs.h	2016-03-22 22:20:16 +01:00
cpu	…
cris	…
display	bcm2835_fb: add framebuffer device for Raspberry Pi	2016-03-16 17:42:18 +00:00
dma	bcm2835_dma: add emulation of Raspberry Pi DMA controller	2016-03-16 17:42:18 +00:00
gpio	i.MX: add support for lower and upper interrupt in GPIO.	2015-12-17 13:37:13 +00:00
i2c	…
i386	Use scripts/clean-includes to drop redundant qemu/typedefs.h	2016-03-22 22:20:16 +01:00
input	cuda: port SET_DEVICE_LIST command to new framework	2016-02-17 09:59:30 +11:00
intc	hw/intc: Add (new) ASPEED VIC device model	2016-03-16 17:42:18 +00:00
ipack	…
ipmi	ipmi: introduce a struct ipmi_sdr_compact	2016-02-06 20:44:09 +02:00
isa	isa: Move DMA_transfer_handler from qemu-common.h to hw/isa/isa.h	2016-03-22 22:20:16 +01:00
kvm	…
lm32	…
m68k	…
mem	nvdimm acpi: emulate dsm method	2016-03-11 16:59:11 +02:00
mips	hw/mips/cps: enable ITU for multithreading processors	2016-03-30 09:14:00 +01:00
misc	hw/mips: implement ITC Configuration Tags and Storage Cells	2016-03-30 09:14:00 +01:00
net	…
nvram	Sort the fw_cfg file list	2016-04-07 19:57:33 +03:00
pci	pcie: fix link active status bit migration	2016-08-05 16:45:19 -05:00
pci-host	spapr_pci: Remove finish_realize hook	2016-03-16 09:55:11 +11:00
ppc	spapr_drc: enable immediate detach for unsignalled devices	2016-04-05 10:47:03 +10:00
s390x	s390x: Introduce S390MachineClass	2016-03-10 10:37:16 +01:00
scsi	scsi: esp: make cmdbuf big enough for maximum CDB size	2016-08-09 14:31:04 -05:00
sd	sdhci: add quirk property for card insert interrupt status on Raspberry Pi	2016-02-26 15:09:42 +00:00
sh4	…
smbios	…
sparc	…
ssi	xilinx_spips: Separate the state struct into a header	2016-01-21 14:15:03 +00:00
timer	Use scripts/clean-includes to drop redundant qemu/typedefs.h	2016-03-22 22:20:16 +01:00
tricore	…
unicore32	…
usb	…
vfio	Use scripts/clean-includes to drop redundant qemu/typedefs.h	2016-03-22 22:20:16 +01:00
virtio	virtio-input: support absolute axis config in pass-through	2016-04-13 17:26:12 +02:00
watchdog	…
xen	Fix some typos found by codespell	2016-08-05 16:14:47 -05:00
boards.h	Sort the fw_cfg file list	2016-04-07 19:57:33 +03:00
bt.h	bt: check struct sizes	2015-12-04 09:39:55 +03:00
compat.h	pcie: fix link active status bit migration	2016-08-05 16:45:19 -05:00
devices.h	…
elf_ops.h	loader: Add data swap option to load-elf	2016-03-04 11:30:21 +00:00
empty_slot.h	…
fw-path-provider.h	…
hotplug.h	Use scripts/clean-includes to drop redundant qemu/typedefs.h	2016-03-22 22:20:16 +01:00
hw.h	include/hw/hw.h: Don't include qemu-common.h	2016-03-22 22:20:16 +01:00
ide.h	…
irq.h	…
loader.h	Sort the fw_cfg file list	2016-04-07 19:57:33 +03:00
nmi.h	…
pcmcia.h	…
platform-bus.h	…
ptimer.h	…
qdev-core.h	Use scripts/clean-includes to drop redundant qemu/typedefs.h	2016-03-22 22:20:16 +01:00
qdev-dma.h	…
qdev-properties.h	qdev: New DEFINE_PROP_ON_OFF_AUTO	2016-03-21 21:29:02 +01:00
qdev.h	…
stream.h	…
sysbus.h	…
usb.h	include/qemu/iov.h: Don't include qemu-common.h	2016-03-22 22:20:16 +01:00