riscv/qemu: QEMU main repository: Please see https://www.qemu.org/docs/master/devel/submitting-a-patch.html for how to submit changes to QEMU. Pull Requests are ignored. Please only use release tarballs from the QEMU website. http://www.qemu.org - qemu

QEMU main repository: Please see https://www.qemu.org/docs/master/devel/submitting-a-patch.html for how to submit changes to QEMU. Pull Requests are ignored. Please only use release tarballs from the QEMU website. http://www.qemu.org

emulation kvm qemu virtualization

History

Christophe de Dinechin 4ce1e15fbc scsi/qemu-pr-helper: Fix out-of-bounds access to trnptid_list[] Compile error reported by gcc 10.0.1: scsi/qemu-pr-helper.c: In function ‘multipath_pr_out’: scsi/qemu-pr-helper.c:523:32: error: array subscript <unknown> is outside array bounds of ‘struct transportid [0]’ [-Werror=array-bounds] 523 \| paramp.trnptid_list[paramp.num_transportid++] = id; \| ~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from scsi/qemu-pr-helper.c:36: /usr/include/mpath_persist.h:168:22: note: while referencing ‘trnptid_list’ 168 \| struct transportid trnptid_list[]; \| ^~~~~~~~~~~~ scsi/qemu-pr-helper.c:424:35: note: defined here ‘paramp’ 424 \| struct prout_param_descriptor paramp; \| ^~~~~~ This highlights an actual implementation issue in function multipath_pr_out. The variable paramp is declared with type `struct prout_param_descriptor`, which is a struct terminated by an empty array in mpath_persist.h: struct transportid *trnptid_list[]; That empty array was filled with code that looked like that: trnptid_list[paramp.descr.num_transportid++] = id; This is an actual out-of-bounds access. The fix is to malloc `paramp`. Signed-off-by: Christophe de Dinechin <dinechin@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>		6 years ago
..
Makefile.objs	pr-manager: put stubs in .c file	8 years ago
pr-helper.h	Normalize header guard symbol definition.	7 years ago
pr-manager-helper.c	Include qemu/module.h where needed, drop it from qemu-common.h	7 years ago
pr-manager-stub.c	pr-manager: add query-pr-managers QMP command	8 years ago
pr-manager.c	pr-manager: Fix invalid g_free() crash bug	7 years ago
qemu-pr-helper.c	scsi/qemu-pr-helper: Fix out-of-bounds access to trnptid_list[]	6 years ago
trace-events	trace-events: Shorten file names in comments	7 years ago
utils.c	iscsi: base all handling of check condition on scsi_sense_to_errno	7 years ago