mirror of
https://github.com/Motorhead1991/qemu.git
synced 2025-08-03 15:53:54 -06:00
ff589551c8
The 53C9X Fast SCSI Controller(FSC) comes with internal 16-byte FIFO buffers. One is used to handle commands and other is for information transfer. Three control variables 'ti_rptr', 'ti_wptr' and 'ti_size' are used to control r/w access to the information transfer buffer ti_buf[TI_BUFSZ=16]. In that, 'ti_rptr' is used as read index, where read occurs. 'ti_wptr' is a write index, where write would occur. 'ti_size' indicates total bytes to be read from the buffer. While reading/writing to this buffer, index could exceed its size. Add check to avoid OOB r/w access. Reported-by: Huawei PSIRT <psirt@huawei.com> Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1465230883-22303-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
||
|---|---|---|
| .. | ||
| esp-pci.c | ||
| esp.c | ||
| lsi53c895a.c | ||
| Makefile.objs | ||
| megasas.c | ||
| mfi.h | ||
| mpi.h | ||
| mptconfig.c | ||
| mptendian.c | ||
| mptsas.c | ||
| mptsas.h | ||
| scsi-bus.c | ||
| scsi-disk.c | ||
| scsi-generic.c | ||
| spapr_vscsi.c | ||
| srp.h | ||
| vhost-scsi.c | ||
| viosrp.h | ||
| virtio-scsi-dataplane.c | ||
| virtio-scsi.c | ||
| vmw_pvscsi.c | ||
| vmw_pvscsi.h | ||