diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2020-05-14 00:55:38 +0530 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2020-06-10 12:10:12 -0400 |
| commit | f50ab86a2620bd7e8507af865b164655ee921661 (patch) | |
| tree | 26df3019b59b085903ae1e860d633057f67dfd84 /hw/riscv | |
| parent | 2a6931425890a9a2822e62f60724a9edbb93ba10 (diff) | |
megasas: use unsigned type for reply_queue_head and check index
A guest user may set 'reply_queue_head' field of MegasasState to
a negative value. Later in 'megasas_lookup_frame' it is used to
index into s->frames[] array. Use unsigned type to avoid OOB
access issue.
Also check that 'index' value stays within s->frames[] bounds
through the while() loop in 'megasas_lookup_frame' to avoid OOB
access.
Reported-by: Ren Ding <rding@gatech.edu>
Reported-by: Hanqing Zhao <hanqing@gatech.edu>
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Acked-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20200513192540.1583887-2-ppandit@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw/riscv')
0 files changed, 0 insertions, 0 deletions