Prasad J Pandit 926cde5f3e scsi: esp: make cmdbuf big enough for maximum CDB size ... While doing DMA read into ESP command buffer 's->cmdbuf', it could write past the 's->cmdbuf' area, if it was transferring more than 16 bytes. Increase the command buffer size to 32, which is maximum when 's->do_cmd' is set, and add a check on 'len' to avoid OOB access. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>		2016-06-16 18:39:05 +02:00
..
Makefile.objs	hw: Add support for LSI SAS1068 (mptsas) device	2016-02-09 15:45:26 +01:00
esp-pci.c	include/qemu/osdep.h: Don't include qapi/error.h	2016-03-22 22:20:15 +01:00
esp.c	scsi: esp: make cmdbuf big enough for maximum CDB size	2016-06-16 18:39:05 +02:00
lsi53c895a.c	hw/scsi: Clean up includes	2016-01-29 15:07:24 +00:00
megasas.c	scsi: megasas: null terminate bios version buffer	2016-06-07 14:09:05 +02:00
mfi.h	megasas: add MegaRAID SAS 2108 emulation	2014-10-31 11:29:00 +01:00
mpi.h	hw: Add support for LSI SAS1068 (mptsas) device	2016-02-09 15:45:26 +01:00
mptconfig.c	mptsas: add missing va_end	2016-02-16 16:41:17 +01:00
mptendian.c	hw: Add support for LSI SAS1068 (mptsas) device	2016-02-09 15:45:26 +01:00
mptsas.c	scsi: mptsas: infinite loop while fetching requests	2016-05-29 09:11:10 +02:00
mptsas.h	hw: Add support for LSI SAS1068 (mptsas) device	2016-02-09 15:45:26 +01:00
scsi-bus.c	util: move declarations out of qemu-common.h	2016-03-22 22:20:17 +01:00
scsi-disk.c	scsi-disk: Use (unsigned long) typecasts when using "%lu" format string	2016-06-16 18:39:04 +02:00
scsi-generic.c	scsi-generic: Merge block max xfer len in INQUIRY response	2016-05-29 09:11:12 +02:00
spapr_vscsi.c	Fix some typos found by codespell	2016-05-18 15:04:27 +03:00
srp.h	spapr-vscsi: add task management	2013-09-12 08:46:21 +02:00
vhost-scsi.c	util: move declarations out of qemu-common.h	2016-03-22 22:20:17 +01:00
viosrp.h	hw: move private headers to hw/ subdirectories.	2013-04-08 18:13:16 +02:00
virtio-scsi-dataplane.c	virtio: merge virtio_queue_aio_set_host_notifier_handler with virtio_queue_set_aio	2016-04-07 19:57:33 +03:00
virtio-scsi.c	virtio: drop duplicate virtio_queue_get_id() function	2016-06-07 14:40:51 +01:00
vmw_pvscsi.c	scsi: pvscsi: check command descriptor ring buffer size (CVE-2016-4952)	2016-05-29 09:11:10 +02:00
vmw_pvscsi.h	scsi: VMWare PVSCSI paravirtual device implementation	2013-04-19 10:44:17 +02:00