Paolo Bonzini 8132122889 ide: atapi: assert that the buffer pointer is in range ... A case was reported where s->io_buffer_index can be out of range. The report skimped on the details but it seems to be triggered by s->lba == -1 on the READ/READ CD paths (e.g. by sending an ATAPI command with LBA = 0xFFFFFFFF). For now paper over it with assertions. The first one ensures that there is no overflow when incrementing s->io_buffer_index, the second checks for the buffer overrun. Note that the buffer overrun is only a read, so I am not sure if the assertion failure is actually less harmful than the overrun. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20201201120926.56559-1-pbonzini@redhat.com Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>		2020-12-01 15:23:05 +00:00
..
9pfs	hw/9pfs: Fix Kconfig dependency problem between 9pfs and Xen	2020-11-05 15:21:11 +01:00
acpi	nomaintainer: Fix Lesser GPL version number	2020-11-15 17:04:40 +01:00
adc	meson: convert hw/adc	2020-08-21 06:30:32 -04:00
alpha	load_elf: Remove unused address variables from callers	2020-09-25 16:52:08 -07:00
arm	hw/arm: Fix bad print format specifiers	2020-11-23 10:41:58 +00:00
audio	nomaintainer: Fix Lesser GPL version number	2020-11-15 17:04:40 +01:00
avr	Use DECLARE_*CHECKER* macros	2020-09-09 09:27:09 -04:00
block	nand: put it into the 'storage' category	2020-11-17 10:17:02 +01:00
char	nomaintainer: Fix Lesser GPL version number	2020-11-15 17:04:40 +01:00
core	Revert "hw/core/qdev-properties: Use qemu_strtoul() in set_pci_host_devaddr()"	2020-11-24 10:06:54 -05:00
cpu	cpu/core: Register core-id and nr-threads as class properties	2020-09-22 16:48:29 -04:00
cris	load_elf: Remove unused address variables from callers	2020-09-25 16:52:08 -07:00
display	hw/display/tcx: add missing 64-bit access for framebuffer blitter	2020-11-22 10:43:30 +00:00
dma	sparc32-ledma: don't reference nd_table directly within the device	2020-10-28 07:59:25 +00:00
gpio	nomaintainer: Fix Lesser GPL version number	2020-11-15 17:04:40 +01:00
hppa	Use OBJECT_DECLARE_SIMPLE_TYPE when possible	2020-09-18 14:12:32 -04:00
hyperv	qemu/atomic.h: rename atomic_ to qatomic_	2020-09-23 16:07:44 +01:00
i2c	nomaintainer: Fix Lesser GPL version number	2020-11-15 17:04:40 +01:00
i386	hw/i386/acpi-build: Fix maybe-uninitialized error when ACPI hotplug off	2020-11-16 11:08:00 +00:00
ide	ide: atapi: assert that the buffer pointer is in range	2020-12-01 15:23:05 +00:00
input	hw/input/ps2.c: Remove remnants of printf debug	2020-11-17 12:56:32 +00:00
intc	hw/intc: fix heap-buffer-overflow in rxicu_realize()	2020-11-23 10:41:58 +00:00
ipack	Use OBJECT_DECLARE_SIMPLE_TYPE when possible	2020-09-18 14:12:32 -04:00
ipmi	Use OBJECT_DECLARE_SIMPLE_TYPE when possible	2020-09-18 14:12:32 -04:00
isa	nomaintainer: Fix Lesser GPL version number	2020-11-15 17:04:40 +01:00
lm32	nomaintainer: Fix Lesser GPL version number	2020-11-15 17:04:40 +01:00
m68k	Use OBJECT_DECLARE_SIMPLE_TYPE when possible	2020-09-18 14:12:32 -04:00
mem	nomaintainer: Fix Lesser GPL version number	2020-11-15 17:04:40 +01:00
microblaze	load_elf: Remove unused address variables from callers	2020-09-25 16:52:08 -07:00
mips	hw/mips/boston: Fix memory leak in boston_fdt_filter() error-handling paths	2020-11-09 00:40:44 +01:00
misc	target-arm queue:	2020-11-17 16:41:47 +00:00
moxie	load_elf: Remove unused address variables from callers	2020-09-25 16:52:08 -07:00
net	hw/net/dp8393x: fix integer underflow in dp8393x_do_transmit_packets()	2020-12-01 10:34:08 +00:00
nios2	load_elf: Remove unused address variables from callers	2020-09-25 16:52:08 -07:00
nubus	meson: convert hw/nubus	2020-08-21 06:30:25 -04:00
nvram	hw/nvram: Always register FW_CFG_DATA_GENERATOR_INTERFACE	2020-10-12 11:50:20 -04:00
openrisc	meson: convert hw/arch*	2020-08-21 06:30:33 -04:00
pci	pci: Disallow improper BAR registration for type 1	2020-10-30 06:48:53 -04:00
pci-bridge	nomaintainer: Fix Lesser GPL version number	2020-11-15 17:04:40 +01:00
pci-host	nomaintainer: Fix Lesser GPL version number	2020-11-15 17:04:40 +01:00
pcmcia	pxa2xx: Move QOM macros to header	2020-08-27 14:04:55 -04:00
ppc	nomaintainer: Fix Lesser GPL version number	2020-11-15 17:04:40 +01:00
rdma	qemu/atomic.h: rename atomic_ to qatomic_	2020-09-23 16:07:44 +01:00
riscv	hw/riscv: microchip_pfsoc: Hook the I2C1 controller	2020-11-03 07:17:23 -08:00
rtc	m48t59: remove legacy m48t59_init() function	2020-10-18 16:21:42 +01:00
rx	hw/rx/rx-gdbsim: Fix memory leak (CID 1432307)	2020-11-09 00:53:07 +01:00
s390x	s390x/pci: fix endianness issues	2020-11-18 16:59:29 +01:00
scsi	scsi-disk: convert more errno values back to SCSI statuses	2020-11-16 13:22:17 -05:00
sd	hw/sd: Fix 2 GiB card CSD register values	2020-11-17 11:45:13 +01:00
semihosting	meson: convert hw/semihosting	2020-08-21 06:30:25 -04:00
sh4	Use OBJECT_DECLARE_SIMPLE_TYPE when possible	2020-09-18 14:12:32 -04:00
smbios	hw/smbios: Fix leaked fd in save_opt_one() error path	2020-11-03 07:19:27 -05:00
sparc	sparc32-ledma: don't reference nd_table directly within the device	2020-10-28 07:59:25 +00:00
sparc64	sabre: don't call sysbus_mmio_map() in sabre_realize()	2020-10-28 07:59:25 +00:00
ssi	ssi: Fix bad printf format specifiers	2020-11-10 11:03:47 +00:00
timer	exynos: Fix bad printf format specifiers	2020-11-17 12:56:32 +00:00
tpm	tpm: Fix Lesser GPL version number	2020-11-15 16:44:18 +01:00
tricore	tricore tcg cpus: Fix Lesser GPL version number	2020-11-15 16:40:30 +01:00
unicore32	meson: convert hw/arch*	2020-08-21 06:30:33 -04:00
usb	usb: fix kconfig for usb-xhci-sysbus	2020-11-20 10:43:41 -05:00
vfio	vfio: Change default dirty pages tracking behavior during migration	2020-11-23 10:05:58 -07:00
virtio	vhost-user: fix VHOST_USER_ADD/REM_MEM_REG truncation	2020-11-12 09:19:40 -05:00
watchdog	hw/watchdog: Implement SBSA watchdog device	2020-10-27 11:10:44 +00:00
xen	nomaintainer: Fix Lesser GPL version number	2020-11-15 17:04:40 +01:00
xenpv	meson: convert hw/arch*	2020-08-21 06:30:33 -04:00
xtensa	load_elf: Remove unused address variables from callers	2020-09-25 16:52:08 -07:00
Kconfig	hw/avr: Add limited support for some Arduino boards	2020-07-11 11:02:05 +02:00
meson.build	meson: convert hw/arch*	2020-08-21 06:30:33 -04:00