[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-commits] [qemu/qemu] 813212: ide: atapi: assert that the buffer po
From: |
Paolo Bonzini |
Subject: |
[Qemu-commits] [qemu/qemu] 813212: ide: atapi: assert that the buffer pointer is in r... |
Date: |
Tue, 01 Dec 2020 08:44:34 -0800 |
Branch: refs/heads/master
Home: https://github.com/qemu/qemu
Commit: 813212288970c39b1800f63e83ac6e96588095c6
https://github.com/qemu/qemu/commit/813212288970c39b1800f63e83ac6e96588095c6
Author: Paolo Bonzini <pbonzini@redhat.com>
Date: 2020-12-01 (Tue, 01 Dec 2020)
Changed paths:
M hw/ide/atapi.c
Log Message:
-----------
ide: atapi: assert that the buffer pointer is in range
A case was reported where s->io_buffer_index can be out of range.
The report skimped on the details but it seems to be triggered
by s->lba == -1 on the READ/READ CD paths (e.g. by sending an
ATAPI command with LBA = 0xFFFFFFFF). For now paper over it
with assertions. The first one ensures that there is no overflow
when incrementing s->io_buffer_index, the second checks for the
buffer overrun.
Note that the buffer overrun is only a read, so I am not sure
if the assertion failure is actually less harmful than the overrun.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20201201120926.56559-1-pbonzini@redhat.com
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Qemu-commits] [qemu/qemu] 813212: ide: atapi: assert that the buffer pointer is in r...,
Paolo Bonzini <=