Paolo Bonzini c170aad8b0 scsi: fix buffer overflow in scsi_req_parse_cdb (CVE-2015-5158)
This is a guest-triggerable buffer overflow present in QEMU 2.2.0
and newer.  scsi_cdb_length returns -1 as an error value, but the
caller does not check it.

Luckily, the massive overflow means that QEMU will just SIGSEGV,
making the impact much smaller.

Reported-by: Zhu Donghai (朱东海) <donghai.zdh@alibaba-inc.com>
Fixes: 1894df0281
Reviewed-by: Fam Zheng <famz@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-07-24 13:57:44 +02:00
2015-07-08 13:11:01 +02:00
2015-07-20 13:35:45 +02:00
2015-07-16 20:00:20 +02:00
…
2015-07-07 14:54:55 +02:00
2015-07-09 15:20:40 +02:00
2015-07-24 13:57:44 +02:00
…
2015-04-04 09:45:59 +03:00
…
…
2015-06-12 06:42:34 +02:00
2015-07-14 21:50:13 -04:00
…
…
…
…
2015-06-03 14:21:24 +03:00
2015-04-30 16:05:48 +03:00
2015-07-09 15:20:40 +02:00
…
2015-06-12 13:42:17 +01:00
2015-07-14 17:15:23 +02:00
2015-06-23 20:23:39 +03:00
…
…
2015-05-11 08:59:07 -04:00
2015-05-22 15:58:22 -04:00
…
2015-06-11 10:13:28 +01:00
2015-07-07 14:54:52 +02:00
2015-07-16 20:32:20 +01:00

Read the documentation in qemu-doc.html or on http://wiki.qemu-project.org

- QEMU team
S
Description
Original Xbox Emulator for Windows, macOS, and Linux (Active Development)
Readme GPL-2.0
717 MiB
0 Stars 1 Watchers 0 Forks
Languages
C 82.3%
C++ 6.9%
Python 3.5%
Dylan 2.7%
Shell 1.5%
Other 2.9%