|
From: | Paolo Bonzini |
Subject: | Re: [Qemu-trivial] [PATCH] scsi: restrict buffer length to req->cmd.xfer for responses to INQUIRY commands. |
Date: | Tue, 24 Jan 2012 09:21:07 +0100 |
User-agent: | Mozilla/5.0 (X11; Linux x86_64; rv:9.0) Gecko/20111222 Thunderbird/9.0 |
On 01/23/2012 07:14 PM, Thomas Higdon wrote:
> Can you please also do the same REPORT LUNS and INQUIRY in hw/scsi-bus.c? You're talking about the scsi_target_emulate_report_luns() and scsi_target_emulate_inquiry() functions in hw/scsi-bus.c? By my read of the code, these appear safe. In both functions, I see len getting set via calls to MIN with r->req->cmd.xfer as one of the arguments. If you're referring to something else, can you be more specific?
Ugh, you're right, sorry. I just looked for if.*xfer. Paolo
[Prev in Thread] | Current Thread | [Next in Thread] |