From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:34157)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <famz@redhat.com>) id 1ZI5QE-0003dh-Sc
	for qemu-devel@nongnu.org; Wed, 22 Jul 2015 21:35:43 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <famz@redhat.com>) id 1ZI5QA-0005BP-H7
	for qemu-devel@nongnu.org; Wed, 22 Jul 2015 21:35:42 -0400
Date: Thu, 23 Jul 2015 09:35:33 +0800
From: Fam Zheng <famz@redhat.com>
Message-ID: <20150723013533.GA7334@ad.nay.redhat.com>
References: <1437574681-18362-1-git-send-email-pbonzini@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <1437574681-18362-1-git-send-email-pbonzini@redhat.com>
Content-Transfer-Encoding: quoted-printable
Subject: Re: [Qemu-devel] [PATCH] scsi: fix buffer overflow in
 scsi_req_parse_cdb (CVE-2015-5158)
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: qemu-devel@nongnu.org, qemu-stable@nongnu.org

On Wed, 07/22 16:18, Paolo Bonzini wrote:
> This is a guest-triggerable buffer overflow present in QEMU 2.2.0
> and newer.  scsi_cdb_length returns -1 as an error value, but the
> caller does not check it.
>=20
> Luckily, the massive overflow means that QEMU will just SIGSEGV,
> making the impact much smaller.
>=20
> Reported-by: Zhu Donghai (=E6=9C=B1=E4=B8=9C=E6=B5=B7) <donghai.zdh@ali=
baba-inc.com>
> Fixes: 1894df02811f6b79ea3ffbf1084599d96f316173
> Cc: qemu-stable@nongnu.org
> ---
>  hw/scsi/scsi-bus.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>=20
> diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
> index f50b2f0..f0ae462 100644
> --- a/hw/scsi/scsi-bus.c
> +++ b/hw/scsi/scsi-bus.c
> @@ -1239,10 +1239,15 @@ int scsi_cdb_length(uint8_t *buf) {
>  int scsi_req_parse_cdb(SCSIDevice *dev, SCSICommand *cmd, uint8_t *buf=
)
>  {
>      int rc;
> +    int len;
> =20
>      cmd->lba =3D -1;
> -    cmd->len =3D scsi_cdb_length(buf);
> +    len =3D scsi_cdb_length(buf);
> +    if (len < 0) {
> +        return -1;
> +    }
> =20
> +    cmd->len =3D len;
>      switch (dev->type) {
>      case TYPE_TAPE:
>          rc =3D scsi_req_stream_xfer(cmd, dev, buf);
> --=20
> 2.4.3
>=20
>=20

Reviewed-by: Fam Zheng <famz@redhat.com>