From d8a2f1e88c5a48a9a120f2d637207075569adf5d Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Fri, 12 Mar 2010 12:14:29 -0300 Subject: [PATCH 2/2] scsi-disk: fix buffer overflow RH-Author: Gerd Hoffmann Message-id: <1268396069-29505-3-git-send-email-kraxel@redhat.com> Patchwork-id: 7688 O-Subject: [RHEL-6 kvm PATCH 2/2] scsi-disk: fix buffer overflow Bugzilla: 558835 RH-Acked-by: Kevin Wolf RH-Acked-by: Juan Quintela RH-Acked-by: Markus Armbruster In case s->version is shorter than 4 bytes we overflow the memcpy src buffer. Fix it by clearing the target buffer, then copy only the amount of bytes we actually have. upstream: submitted (http://patchwork.ozlabs.org/patch/47257/) --- hw/scsi-disk.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) Signed-off-by: Eduardo Habkost --- hw/scsi-disk.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c index 4ed6ab2..f45a078 100644 --- a/hw/scsi-disk.c +++ b/hw/scsi-disk.c @@ -438,7 +438,9 @@ static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf) memcpy(&outbuf[16], "QEMU HARDDISK ", 16); } memcpy(&outbuf[8], "QEMU ", 8); - memcpy(&outbuf[32], s->version ? s->version : QEMU_VERSION, 4); + memset(&outbuf[32], 0, 4); + memcpy(&outbuf[32], s->version ? s->version : QEMU_VERSION, + MIN(4, strlen(s->version ? s->version : QEMU_VERSION))); /* Identify device as SCSI-3 rev 1. Some later commands are also implemented. */ outbuf[2] = 3; -- 1.6.3.rc4.29.g8146