]> git.ipfire.org Git - thirdparty/qemu.git/commit
scsi: lsi: exit infinite loop while executing script (CVE-2019-12068)
authorPaolo Bonzini <pbonzini@redhat.com>
Wed, 14 Aug 2019 12:05:21 +0000 (17:35 +0530)
committerMichael Roth <mdroth@linux.vnet.ibm.com>
Tue, 5 Nov 2019 19:39:31 +0000 (13:39 -0600)
commit051c9b3cbcb4beb42a6ed017c2146ec3e7a754fb
tree34013ef22ba394374f98cc568ef01c48f2f12128
parentb387531323ef1e2819f241a7d3bac86fa1ecb8b9
scsi: lsi: exit infinite loop while executing script (CVE-2019-12068)

When executing script in lsi_execute_script(), the LSI scsi adapter
emulator advances 's->dsp' index to read next opcode. This can lead
to an infinite loop if the next opcode is empty. Move the existing
loop exit after 10k iterations so that it covers no-op opcodes as
well.

Reported-by: Bugs SysSec <bugs-syssec@rub.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit de594e47659029316bbf9391efb79da0a1a08e08)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
hw/scsi/lsi53c895a.c