OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

esp: check command buffer length before write(CVE-2016-4439)

Browse Source 
The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte
FIFO buffer. It is used to handle command and data transfer. While
writing to this command buffer 's->cmdbuf[TI_BUFSZ=16]', a check
was missing to validate input length. Add check to avoid OOB write
access.

Fixes CVE-2016-4439.

Reported-by: Li Qiang <liqiang6-s@360.cn>
Cc: qemu-stable@nongnu.org
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <1463654371-11169-2-git-send-email-ppandit@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Prasad J Pandit 2016-05-19 16:09:30 +05:30 committed by Paolo Bonzini
parent fd28938b7a
commit c98c6c105f
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hw/scsi/esp.c
View File

@ -448,7 +448,11 @@ void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
break; break;
case ESP_FIFO: case ESP_FIFO:
if (s->do_cmd) { if (s->do_cmd) {
s->cmdbuf[s->cmdlen++] = val & 0xff; if (s->cmdlen < TI_BUFSZ) {
s->cmdbuf[s->cmdlen++] = val & 0xff;
} else {
trace_esp_error_fifo_overrun();
}
} else if (s->ti_size == TI_BUFSZ - 1) { } else if (s->ti_size == TI_BUFSZ - 1) {
trace_esp_error_fifo_overrun(); trace_esp_error_fifo_overrun();
} else { } else {