3a13ddd514
CVE-2016-7156: pvscsi: infinite loop when building SG list (bz #1373480) CVE-2016-7156: pvscsi: infinite loop when processing IO requests (bz #1373480) CVE-2016-7170: vmware_vga: OOB stack memory access (bz #1374709) CVE-2016-7157: mptsas: invalid memory access (bz #1373505) CVE-2016-7466: usb: xhci memory leakage during device unplug (bz #1377838) CVE-2016-7423: scsi: mptsas: OOB access (bz #1376777) CVE-2016-7422: virtio: null pointer dereference (bz #1376756) CVE-2016-7908: net: Infinite loop in mcf_fec_do_tx (bz #1381193) CVE-2016-8576: usb: xHCI: infinite loop vulnerability (bz #1382322) CVE-2016-7995: usb: hcd-ehci: memory leak (bz #1382669)
38 lines
1.4 KiB
Diff
38 lines
1.4 KiB
Diff
From: Paolo Bonzini <pbonzini@redhat.com>
|
|
Date: Mon, 29 Aug 2016 11:35:37 +0200
|
|
Subject: [PATCH] scsi: mptconfig: fix misuse of MPTSAS_CONFIG_PACK
|
|
|
|
These issues cause respectively a QEMU crash and a leak of 2 bytes of
|
|
stack. They were discovered by VictorV of 360 Marvel Team.
|
|
|
|
Reported-by: Tom Victor <i-tangtianwen@360.cm>
|
|
Cc: qemu-stable@nongnu.org
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
(cherry picked from commit 65a8e1f6413a0f6f79894da710b5d6d43361d27d)
|
|
---
|
|
hw/scsi/mptconfig.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/hw/scsi/mptconfig.c b/hw/scsi/mptconfig.c
|
|
index 3e4f400..87a416a 100644
|
|
--- a/hw/scsi/mptconfig.c
|
|
+++ b/hw/scsi/mptconfig.c
|
|
@@ -203,7 +203,7 @@ size_t mptsas_config_manufacturing_1(MPTSASState *s, uint8_t **data, int address
|
|
{
|
|
/* VPD - all zeros */
|
|
return MPTSAS_CONFIG_PACK(1, MPI_CONFIG_PAGETYPE_MANUFACTURING, 0x00,
|
|
- "s256");
|
|
+ "*s256");
|
|
}
|
|
|
|
static
|
|
@@ -328,7 +328,7 @@ size_t mptsas_config_ioc_0(MPTSASState *s, uint8_t **data, int address)
|
|
return MPTSAS_CONFIG_PACK(0, MPI_CONFIG_PAGETYPE_IOC, 0x01,
|
|
"*l*lwwb*b*b*blww",
|
|
pcic->vendor_id, pcic->device_id, pcic->revision,
|
|
- pcic->subsystem_vendor_id,
|
|
+ pcic->class_id, pcic->subsystem_vendor_id,
|
|
pcic->subsystem_id);
|
|
}
|
|
|