qemu/scsi at stable-2.3 - qemu - Gitea: Git with a cup of tea

mii/qemu

mirror of https://github.com/mii443/qemu.git synced 2025-08-23 23:49:36 +00:00

Files

Paolo Bonzini 961c74a841 scsi: fix buffer overflow in scsi_req_parse_cdb (CVE-2015-5158)

This is a guest-triggerable buffer overflow present in QEMU 2.2.0
and newer.  scsi_cdb_length returns -1 as an error value, but the
caller does not check it.

Luckily, the massive overflow means that QEMU will just SIGSEGV,
making the impact much smaller.

Reported-by: Zhu Donghai (朱东海) <donghai.zdh@alibaba-inc.com>
Fixes: 1894df0281
Reviewed-by: Fam Zheng <famz@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit c170aad8b0)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

2015-07-29 22:13:25 -05:00

esp-pci.c

scsi: Convert remaining PCI HBAs to realize()

2015-03-10 11:18:23 +01:00

esp.c

esp: Do not overwrite ESP_TCHI after reset

2014-11-12 10:27:03 +01:00

lsi53c895a.c

scsi: Convert remaining PCI HBAs to realize()

2015-03-10 11:18:23 +01:00

Makefile.objs

virtio-scsi-dataplane: Code to run virtio-scsi on iothread