Could this cause OOB bug ?

Bug #1882065 reported by r1ng0hacking
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
QEMU
Fix Released
Undecided
Unassigned

Bug Description

In function megasas_handle_scsi(hw/scsi/megasas.c):

```c
static int megasas_handle_scsi(MegasasState *s, MegasasCmd *cmd,
                               int frame_cmd)
{
    ............................................................................
    cdb = cmd->frame->pass.cdb;
    target_id = cmd->frame->header.target_id;
    lun_id = cmd->frame->header.lun_id;
    cdb_len = cmd->frame->header.cdb_len;
    ............................................................................
    if (cdb_len > 16) {
        trace_megasas_scsi_invalid_cdb_len(
                mfi_frame_desc[frame_cmd], is_logical,
                target_id, lun_id, cdb_len);
        megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
        cmd->frame->header.scsi_status = CHECK_CONDITION;
        s->event_count++;
        return MFI_STAT_SCSI_DONE_WITH_ERROR;
    }
}
```

Two variables, frame_cmd and cdb_len, can be controlled by guest os. So can mfi_frame_desc[frame_cmd] cause OOB bug ?

Revision history for this message
r1ng0hacking (r1ng0hacking) wrote :

QEMU emulator version 5.0.50 (v5.0.0-533-gdebe78ce14-dirty)

Revision history for this message
r1ng0hacking (r1ng0hacking) wrote :

You must start the trace function of QEMU to trigger this BUG!

description: updated
Revision history for this message
Thomas Huth (th-huth) wrote :

I think we should fix this anyway, even if it can only be triggered when trace functions are enabled

description: updated
Revision history for this message
Thomas Huth (th-huth) wrote :
Changed in qemu:
status: New → Fix Committed
Thomas Huth (th-huth)
Changed in qemu:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.