diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2016-06-07 16:44:03 +0530 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2016-08-09 14:31:33 -0500 |
| commit | 407fb6fce916b8984b5fd288b4a97d61f014dc72 (patch) | |
| tree | e5830c719ccb913fd1532d58ebd6edf76b09df73 | |
| parent | 27fa5e735a267d21b3ae040b059636d5063bb7e4 (diff) | |
| download | qemu-407fb6fce916b8984b5fd288b4a97d61f014dc72.tar.gz | |
scsi: megasas: null terminate bios version buffer
While reading information via 'megasas_ctrl_get_info' routine,
a local bios version buffer isn't null terminated. Add the
terminating null byte to avoid any OOB access.
Reported-by: Li Qiang <liqiang6-s@360.cn>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 844864fbae66935951529408831c2f22367a57b6)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | hw/scsi/megasas.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c index cc66d36186..a9ffc32682 100644 --- a/hw/scsi/megasas.c +++ b/hw/scsi/megasas.c @@ -773,6 +773,7 @@ static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd) ptr = memory_region_get_ram_ptr(&pci_dev->rom); memcpy(biosver, ptr + 0x41, 31); + biosver[31] = 0; memcpy(info.image_component[1].name, "BIOS", 4); memcpy(info.image_component[1].version, biosver, strlen((const char *)biosver)); |