diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2016-06-07 16:44:03 +0530 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2016-06-07 14:09:05 +0200 |
| commit | 844864fbae66935951529408831c2f22367a57b6 (patch) | |
| tree | 66baf9a29ae51a612322c404e62ab5ac3d7e5169 /hw/scsi | |
| parent | 6214a11ac167b1e866c04a81360286d186f04d82 (diff) | |
| download | qemu-844864fbae66935951529408831c2f22367a57b6.tar.gz qemu-844864fbae66935951529408831c2f22367a57b6.tar.bz2 qemu-844864fbae66935951529408831c2f22367a57b6.zip | |
scsi: megasas: null terminate bios version buffer
While reading information via 'megasas_ctrl_get_info' routine,
a local bios version buffer isn't null terminated. Add the
terminating null byte to avoid any OOB access.
Reported-by: Li Qiang <liqiang6-s@360.cn>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw/scsi')
| -rw-r--r-- | hw/scsi/megasas.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c index cc66d36186..a9ffc32682 100644 --- a/hw/scsi/megasas.c +++ b/hw/scsi/megasas.c @@ -773,6 +773,7 @@ static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd) ptr = memory_region_get_ram_ptr(&pci_dev->rom); memcpy(biosver, ptr + 0x41, 31); + biosver[31] = 0; memcpy(info.image_component[1].name, "BIOS", 4); memcpy(info.image_component[1].version, biosver, strlen((const char *)biosver)); |