[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH 1/3] scsi: megasas: use appropriate property buf

From: P J P
Subject: Re: [Qemu-devel] [PATCH 1/3] scsi: megasas: use appropriate property buffer size
Date: Wed, 25 May 2016 17:45:12 +0530 (IST)

+-- On Wed, 25 May 2016, Alexander Graf wrote --+
| >    
| > 'dcmd_size' is same as that of 'info' object.
| Ok, then this patch is definitely bogus. The guest may receive less than the
| size of the info object. So we really want to have a MIN() between the maximum
| allowed transfer size (sizeof(info)) and the requested size (cmd->iov_size)
| here.

There is also a check which returns an invalid parameter error if 
'cmd->iov_size' is less than 'dcmd_size'. Ie. OOB access occurs when 
cmd->iov_size is greater than 'dcmd_size'.

Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F

reply via email to

[Prev in Thread] Current Thread [Next in Thread]