qemu-e2k/scsi
Christophe de Dinechin 4ce1e15fbc scsi/qemu-pr-helper: Fix out-of-bounds access to trnptid_list[]
Compile error reported by gcc 10.0.1:

scsi/qemu-pr-helper.c: In function ‘multipath_pr_out’:
scsi/qemu-pr-helper.c:523:32: error: array subscript <unknown> is outside array bounds of ‘struct transportid *[0]’ [-Werror=array-bounds]
  523 |             paramp.trnptid_list[paramp.num_transportid++] = id;
      |             ~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from scsi/qemu-pr-helper.c:36:
/usr/include/mpath_persist.h:168:22: note: while referencing ‘trnptid_list’
  168 |  struct transportid *trnptid_list[];
      |                      ^~~~~~~~~~~~
scsi/qemu-pr-helper.c:424:35: note: defined here ‘paramp’
  424 |     struct prout_param_descriptor paramp;
      |                                   ^~~~~~

This highlights an actual implementation issue in function multipath_pr_out.
The variable paramp is declared with type `struct prout_param_descriptor`,
which is a struct terminated by an empty array in mpath_persist.h:

        struct transportid *trnptid_list[];

That empty array was filled with code that looked like that:

        trnptid_list[paramp.descr.num_transportid++] = id;

This is an actual out-of-bounds access.

The fix is to malloc `paramp`.

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-03-16 22:07:24 +01:00
..
Makefile.objs pr-manager: put stubs in .c file 2018-06-28 19:05:35 +02:00
pr-helper.h Normalize header guard symbol definition. 2019-05-13 08:58:55 +02:00
pr-manager-helper.c Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
pr-manager-stub.c pr-manager: add query-pr-managers QMP command 2018-06-28 19:05:35 +02:00
pr-manager.c pr-manager: Fix invalid g_free() crash bug 2019-09-10 08:58:43 +02:00
qemu-pr-helper.c scsi/qemu-pr-helper: Fix out-of-bounds access to trnptid_list[] 2020-03-16 22:07:24 +01:00
trace-events trace-events: Shorten file names in comments 2019-03-22 16:18:07 +00:00
utils.c iscsi: base all handling of check condition on scsi_sense_to_errno 2019-07-15 11:20:42 +02:00