In function megasas_handle_scsi(hw/scsi/megasas.c):
```c static int megasas_handle_scsi(MegasasState *s, MegasasCmd *cmd, int frame_cmd) { ............................................................................ cdb = cmd->frame->pass.cdb; target_id = cmd->frame->header.target_id; lun_id = cmd->frame->header.lun_id; cdb_len = cmd->frame->header.cdb_len; ............................................................................ if (cdb_len > 16) { trace_megasas_scsi_invalid_cdb_len( mfi_frame_desc[frame_cmd], is_logical, target_id, lun_id, cdb_len); megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE)); cmd->frame->header.scsi_status = CHECK_CONDITION; s->event_count++; return MFI_STAT_SCSI_DONE_WITH_ERROR; } } ```
Two variables, frame_cmd and cdb_len, can be controlled by guest os. So can mfi_frame_desc[frame_cmd] cause OOB bug ?
In function megasas_ handle_ scsi(hw/ scsi/megasas. c):
```c handle_ scsi(MegasasSta te *s, MegasasCmd *cmd,
int frame_cmd) ....... ....... ....... ....... ....... ....... ....... ....... ....... ....... ... >pass.cdb; >header. target_ id; >header. lun_id; >header. cdb_len; ....... ....... ....... ....... ....... ....... ....... ....... ....... ....... ...
trace_ megasas_ scsi_invalid_ cdb_len(
mfi_frame_ desc[frame_ cmd], is_logical,
target_ id, lun_id, cdb_len);
megasas_ write_sense( cmd, SENSE_CODE( INVALID_ OPCODE) );
cmd->frame- >header. scsi_status = CHECK_CONDITION;
s->event_ count++ ; SCSI_DONE_ WITH_ERROR;
static int megasas_
{
...
cdb = cmd->frame-
target_id = cmd->frame-
lun_id = cmd->frame-
cdb_len = cmd->frame-
...
if (cdb_len > 16) {
return MFI_STAT_
}
}
```
Two variables, frame_cmd and cdb_len, can be controlled by guest os. So can mfi_frame_ desc[frame_ cmd] cause OOB bug ?