On 26 October 2018 at 20:43, P J P <ppan...@redhat.com> wrote: > From: Prasad J Pandit <p...@fedoraproject.org> > > While writing a message in 'lsi_do_msgin', message length value > in 'msg_len' could be invalid. Add check to avoid OOB access issue. > > Signed-off-by: Prasad J Pandit <p...@fedoraproject.org> > --- > hw/scsi/lsi53c895a.c | 15 ++++++++++++++- > 1 file changed, 14 insertions(+), 1 deletion(-) > > Update v1: add .post_load routine and an assert() call > -> https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg05730.html > > diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c > index d1e6534311..3a40e62853 100644 > --- a/hw/scsi/lsi53c895a.c > +++ b/hw/scsi/lsi53c895a.c > @@ -861,12 +861,13 @@ static void lsi_do_status(LSIState *s) > > static void lsi_do_msgin(LSIState *s) > { > - int len; > + uint8_t len; > trace_lsi_do_msgin(s->dbc, s->msg_len); > s->sfbr = s->msg[0]; > len = s->msg_len; > if (len > s->dbc) > len = s->dbc; > + assert(len <= LSI_MAX_MSGIN_LEN); > pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len); > /* Linux drivers rely on the last byte being in the SIDL. */ > s->sidl = s->msg[len - 1];
Is it possible to get here with len == 0 ? thanks -- PMM
