From: Gerd Hoffmann Date: Wed, 10 Mar 2010 16:47:17 +0000 (+0100) Subject: scsi-disk: fix buffer overflow X-Git-Tag: v0.13.0-rc0~1047 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=314b1811c15f4e982e4667d9b845aee4b5a63d91;p=thirdparty%2Fqemu.git scsi-disk: fix buffer overflow In case s->version is shorter than 4 bytes we overflow the memcpy src buffer. Fix it by clearing the target buffer, then copy only the amount of bytes we actually have. Signed-off-by: Gerd Hoffmann Signed-off-by: Anthony Liguori --- diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c index 1fbd4ee1bb5..77cb1daec83 100644 --- a/hw/scsi-disk.c +++ b/hw/scsi-disk.c @@ -460,7 +460,9 @@ static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf) memcpy(&outbuf[16], "QEMU HARDDISK ", 16); } memcpy(&outbuf[8], "QEMU ", 8); - memcpy(&outbuf[32], s->version ? s->version : QEMU_VERSION, 4); + memset(&outbuf[32], 0, 4); + memcpy(&outbuf[32], s->version ? s->version : QEMU_VERSION, + MIN(4, strlen(s->version ? s->version : QEMU_VERSION))); /* * We claim conformance to SPC-3, which is required for guests * to ask for modern features like READ CAPACITY(16) or the