From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1NpP47-0002TC-KU for qemu-devel@nongnu.org; Wed, 10 Mar 2010 11:47:23 -0500 Received: from [199.232.76.173] (port=44739 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NpP47-0002SQ-0w for qemu-devel@nongnu.org; Wed, 10 Mar 2010 11:47:23 -0500 Received: from Debian-exim by monty-python.gnu.org with spam-scanned (Exim 4.60) (envelope-from ) id 1NpP45-0001AW-PX for qemu-devel@nongnu.org; Wed, 10 Mar 2010 11:47:22 -0500 Received: from mx1.redhat.com ([209.132.183.28]:46744) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1NpP45-0001AQ-EF for qemu-devel@nongnu.org; Wed, 10 Mar 2010 11:47:21 -0500 Received: from int-mx04.intmail.prod.int.phx2.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.17]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o2AGlKkv016442 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 10 Mar 2010 11:47:20 -0500 From: Gerd Hoffmann Date: Wed, 10 Mar 2010 17:47:17 +0100 Message-Id: <1268239637-24524-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PATCH] scsi-disk: fix buffer overflow List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gerd Hoffmann In case s->version is shorter than 4 bytes we overflow the memcpy src buffer. Fix it by clearing the target buffer, then copy only the amount of bytes we actually have. Signed-off-by: Gerd Hoffmann --- hw/scsi-disk.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c index b2f61fe..5792545 100644 --- a/hw/scsi-disk.c +++ b/hw/scsi-disk.c @@ -459,7 +459,9 @@ static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf) memcpy(&outbuf[16], "QEMU HARDDISK ", 16); } memcpy(&outbuf[8], "QEMU ", 8); - memcpy(&outbuf[32], s->version ? s->version : QEMU_VERSION, 4); + memset(&outbuf[32], 0, 4); + memcpy(&outbuf[32], s->version ? s->version : QEMU_VERSION, + MIN(4, strlen(s->version ? s->version : QEMU_VERSION))); /* Identify device as SCSI-3 rev 1. Some later commands are also implemented. */ outbuf[2] = 5; -- 1.6.6.1