From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52653) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ai3es-0003pA-JM for qemu-devel@nongnu.org; Mon, 21 Mar 2016 13:30:27 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ai3ep-0001ds-9n for qemu-devel@nongnu.org; Mon, 21 Mar 2016 13:30:26 -0400 Received: from e38.co.us.ibm.com ([32.97.110.159]:51320) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ai3ep-0001dd-2N for qemu-devel@nongnu.org; Mon, 21 Mar 2016 13:30:23 -0400 Received: from localhost by e38.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 21 Mar 2016 11:30:21 -0600 From: Michael Roth Date: Mon, 21 Mar 2016 12:28:06 -0500 Message-Id: <1458581313-19045-9-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1458581313-19045-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1458581313-19045-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 08/35] scsi: initialise info object with appropriate size List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Michael Roth , Paolo Bonzini , Prasad J Pandit , qemu-stable@nongnu.org, P J P From: P J P While processing controller 'CTRL_GET_INFO' command, the routine 'megasas_ctrl_get_info' overflows the '&info' object size. Use its appropriate size to null initialise it. Reported-by: Qinghao Tang Signed-off-by: Prasad J Pandit Message-Id: Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini Signed-off-by: P J P (cherry picked from commit 36fef36b91f7ec0435215860f1458b5342ce2811) Signed-off-by: Michael Roth --- hw/scsi/megasas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c index d7dc667..576f56c 100644 --- a/hw/scsi/megasas.c +++ b/hw/scsi/megasas.c @@ -718,7 +718,7 @@ static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd) BusChild *kid; int num_pd_disks = 0; - memset(&info, 0x0, cmd->iov_size); + memset(&info, 0x0, dcmd_size); if (cmd->iov_size < dcmd_size) { trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size, dcmd_size); -- 1.9.1