mirror of
https://gitlab.com/qemu-project/qemu
synced 2024-09-06 18:05:37 +00:00
![]() On Fedora 33, gcc 10.2.1 notes that scsi_cdb_length(buf) can set len==-1, which in turn overflows g_malloc(): [5/5] Linking target qemu-system-x86_64 In function ‘scsi_disk_new_request_dump’, inlined from ‘scsi_new_request’ at ../hw/scsi/scsi-disk.c:2608:9: ../hw/scsi/scsi-disk.c:2582:19: warning: argument 1 value ‘18446744073709551612’ exceeds maximum object size 9223372036854775807 [-Walloc-size-larger-than=] 2582 | line_buffer = g_malloc(len * 5 + 1); | ^ Silence it with a decent assertion, since we only convert a buffer to bytes when we have a valid cdb length. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210209152350.207958-1-eblake@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu> |
||
---|---|---|
.. | ||
emulation.c | ||
esp-pci.c | ||
esp.c | ||
Kconfig | ||
lsi53c895a.c | ||
megasas.c | ||
meson.build | ||
mfi.h | ||
mpi.h | ||
mptconfig.c | ||
mptendian.c | ||
mptsas.c | ||
mptsas.h | ||
scsi-bus.c | ||
scsi-disk.c | ||
scsi-generic.c | ||
spapr_vscsi.c | ||
srp.h | ||
trace-events | ||
trace.h | ||
vhost-scsi-common.c | ||
vhost-scsi.c | ||
vhost-user-scsi.c | ||
viosrp.h | ||
virtio-scsi-dataplane.c | ||
virtio-scsi.c | ||
vmw_pvscsi.c | ||
vmw_pvscsi.h |