* [Qemu-devel] [PATCH] scsi-disk: fix buffer overflow
@ 2010-03-10 16:47 Gerd Hoffmann
2010-03-13 11:19 ` Aurelien Jarno
2010-03-17 16:59 ` Anthony Liguori
0 siblings, 2 replies; 3+ messages in thread
From: Gerd Hoffmann @ 2010-03-10 16:47 UTC (permalink / raw)
To: qemu-devel; +Cc: Gerd Hoffmann
In case s->version is shorter than 4 bytes we overflow the memcpy src
buffer. Fix it by clearing the target buffer, then copy only the
amount of bytes we actually have.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
hw/scsi-disk.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index b2f61fe..5792545 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -459,7 +459,9 @@ static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf)
memcpy(&outbuf[16], "QEMU HARDDISK ", 16);
}
memcpy(&outbuf[8], "QEMU ", 8);
- memcpy(&outbuf[32], s->version ? s->version : QEMU_VERSION, 4);
+ memset(&outbuf[32], 0, 4);
+ memcpy(&outbuf[32], s->version ? s->version : QEMU_VERSION,
+ MIN(4, strlen(s->version ? s->version : QEMU_VERSION)));
/* Identify device as SCSI-3 rev 1.
Some later commands are also implemented. */
outbuf[2] = 5;
--
1.6.6.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [Qemu-devel] [PATCH] scsi-disk: fix buffer overflow
2010-03-10 16:47 [Qemu-devel] [PATCH] scsi-disk: fix buffer overflow Gerd Hoffmann
@ 2010-03-13 11:19 ` Aurelien Jarno
2010-03-17 16:59 ` Anthony Liguori
1 sibling, 0 replies; 3+ messages in thread
From: Aurelien Jarno @ 2010-03-13 11:19 UTC (permalink / raw)
To: Gerd Hoffmann; +Cc: qemu-devel
On Wed, Mar 10, 2010 at 05:47:17PM +0100, Gerd Hoffmann wrote:
> In case s->version is shorter than 4 bytes we overflow the memcpy src
> buffer. Fix it by clearing the target buffer, then copy only the
> amount of bytes we actually have.
>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
> hw/scsi-disk.c | 4 +++-
> 1 files changed, 3 insertions(+), 1 deletions(-)
>
> diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
> index b2f61fe..5792545 100644
> --- a/hw/scsi-disk.c
> +++ b/hw/scsi-disk.c
> @@ -459,7 +459,9 @@ static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf)
> memcpy(&outbuf[16], "QEMU HARDDISK ", 16);
> }
> memcpy(&outbuf[8], "QEMU ", 8);
> - memcpy(&outbuf[32], s->version ? s->version : QEMU_VERSION, 4);
> + memset(&outbuf[32], 0, 4);
> + memcpy(&outbuf[32], s->version ? s->version : QEMU_VERSION,
> + MIN(4, strlen(s->version ? s->version : QEMU_VERSION)));
Wouldn't be simpler to use strncpy() instead of a memcpy()?
> /* Identify device as SCSI-3 rev 1.
> Some later commands are also implemented. */
> outbuf[2] = 5;
> --
> 1.6.6.1
>
>
>
>
--
Aurelien Jarno GPG: 1024D/F1BCDB73
aurelien@aurel32.net http://www.aurel32.net
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Qemu-devel] [PATCH] scsi-disk: fix buffer overflow
2010-03-10 16:47 [Qemu-devel] [PATCH] scsi-disk: fix buffer overflow Gerd Hoffmann
2010-03-13 11:19 ` Aurelien Jarno
@ 2010-03-17 16:59 ` Anthony Liguori
1 sibling, 0 replies; 3+ messages in thread
From: Anthony Liguori @ 2010-03-17 16:59 UTC (permalink / raw)
To: Gerd Hoffmann; +Cc: qemu-devel
On 03/10/2010 10:47 AM, Gerd Hoffmann wrote:
> In case s->version is shorter than 4 bytes we overflow the memcpy src
> buffer. Fix it by clearing the target buffer, then copy only the
> amount of bytes we actually have.
>
> Signed-off-by: Gerd Hoffmann<kraxel@redhat.com>
>
Applied. Thanks.
Regards,
Anthony Liguori
> ---
> hw/scsi-disk.c | 4 +++-
> 1 files changed, 3 insertions(+), 1 deletions(-)
>
> diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
> index b2f61fe..5792545 100644
> --- a/hw/scsi-disk.c
> +++ b/hw/scsi-disk.c
> @@ -459,7 +459,9 @@ static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf)
> memcpy(&outbuf[16], "QEMU HARDDISK ", 16);
> }
> memcpy(&outbuf[8], "QEMU ", 8);
> - memcpy(&outbuf[32], s->version ? s->version : QEMU_VERSION, 4);
> + memset(&outbuf[32], 0, 4);
> + memcpy(&outbuf[32], s->version ? s->version : QEMU_VERSION,
> + MIN(4, strlen(s->version ? s->version : QEMU_VERSION)));
> /* Identify device as SCSI-3 rev 1.
> Some later commands are also implemented. */
> outbuf[2] = 5;
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-03-17 16:59 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-03-10 16:47 [Qemu-devel] [PATCH] scsi-disk: fix buffer overflow Gerd Hoffmann
2010-03-13 11:19 ` Aurelien Jarno
2010-03-17 16:59 ` Anthony Liguori
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.