diff options
| author | Gerd Hoffmann <kraxel@redhat.com> | 2010-03-10 17:47:17 +0100 |
|---|---|---|
| committer | Aurelien Jarno <aurelien@aurel32.net> | 2010-04-09 18:41:59 +0200 |
| commit | 4f7cb969319be00ffce3dee6426d1b4ae95d2d83 (patch) | |
| tree | a6a626609085d6d5740dce849504c0771193659e | |
| parent | fafc2e4b33220afd52b9e4bab1091b5861c8e5c4 (diff) | |
scsi-disk: fix buffer overflow
In case s->version is shorter than 4 bytes we overflow the memcpy src
buffer. Fix it by clearing the target buffer, then copy only the
amount of bytes we actually have.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from 314b1811c15f4e982e4667d9b845aee4b5a63d91)
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
| -rw-r--r-- | hw/scsi-disk.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c index b34fbaa674..a79201213f 100644 --- a/hw/scsi-disk.c +++ b/hw/scsi-disk.c @@ -434,7 +434,9 @@ static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf) memcpy(&outbuf[16], "QEMU HARDDISK ", 16); } memcpy(&outbuf[8], "QEMU ", 8); - memcpy(&outbuf[32], s->version ? s->version : QEMU_VERSION, 4); + memset(&outbuf[32], 0, 4); + memcpy(&outbuf[32], s->version ? s->version : QEMU_VERSION, + MIN(4, strlen(s->version ? s->version : QEMU_VERSION))); /* Identify device as SCSI-3 rev 1. Some later commands are also implemented. */ outbuf[2] = 3; |