Prasad J Pandit b60bdd1f1e scsi: megasas: check 'read_queue_head' index value ...

While doing MegaRAID SAS controller command frame lookup, routine
'megasas_lookup_frame' uses 'read_queue_head' value as an index
into 'frames[MEGASAS_MAX_FRAMES=2048]' array. Limit its value
within array bounds to avoid any OOB access.

Reported-by: Li Qiang <liqiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <1464179110-18593-1-git-send-email-ppandit@redhat.com>
Reviewed-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

2016-05-29 09:11:11 +02:00

..

esp-pci.c

include/qemu/osdep.h: Don't include qapi/error.h

2016-03-22 22:20:15 +01:00

esp.c

esp: check dma length before reading scsi command(CVE-2016-4441)

2016-05-23 16:53:46 +02:00

lsi53c895a.c

hw/scsi: Clean up includes

2016-01-29 15:07:24 +00:00

Makefile.objs

hw: Add support for LSI SAS1068 (mptsas) device

2016-02-09 15:45:26 +01:00

megasas.c

scsi: megasas: check 'read_queue_head' index value

2016-05-29 09:11:11 +02:00

mfi.h

megasas: add MegaRAID SAS 2108 emulation

2014-10-31 11:29:00 +01:00

mpi.h

hw: Add support for LSI SAS1068 (mptsas) device

2016-02-09 15:45:26 +01:00

mptconfig.c

mptsas: add missing va_end

2016-02-16 16:41:17 +01:00

mptendian.c

hw: Add support for LSI SAS1068 (mptsas) device

2016-02-09 15:45:26 +01:00

mptsas.c

scsi: mptsas: infinite loop while fetching requests

2016-05-29 09:11:10 +02:00

mptsas.h

hw: Add support for LSI SAS1068 (mptsas) device

2016-02-09 15:45:26 +01:00

scsi-bus.c

util: move declarations out of qemu-common.h

2016-03-22 22:20:17 +01:00

scsi-disk.c

block: Rename blk_write_zeroes()

2016-05-25 19:04:21 +02:00

scsi-generic.c

include/qemu/osdep.h: Don't include qapi/error.h

2016-03-22 22:20:15 +01:00

spapr_vscsi.c

Fix some typos found by codespell

2016-05-18 15:04:27 +03:00

srp.h

spapr-vscsi: add task management

2013-09-12 08:46:21 +02:00

vhost-scsi.c

util: move declarations out of qemu-common.h

2016-03-22 22:20:17 +01:00

viosrp.h

hw: move private headers to hw/ subdirectories.

2013-04-08 18:13:16 +02:00

virtio-scsi-dataplane.c

virtio: merge virtio_queue_aio_set_host_notifier_handler with virtio_queue_set_aio

2016-04-07 19:57:33 +03:00

virtio-scsi.c

virtio-scsi: use aio handler for data plane

2016-04-07 19:57:33 +03:00

vmw_pvscsi.c

scsi: pvscsi: check command descriptor ring buffer size (CVE-2016-4952)

2016-05-29 09:11:10 +02:00

vmw_pvscsi.h

scsi: VMWare PVSCSI paravirtual device implementation

2013-04-19 10:44:17 +02:00