Skip to content
  • Christophe de Dinechin's avatar
    4ce1e15f
    scsi/qemu-pr-helper: Fix out-of-bounds access to trnptid_list[] · 4ce1e15f
    Christophe de Dinechin authored
    
    
    Compile error reported by gcc 10.0.1:
    
    scsi/qemu-pr-helper.c: In function ‘multipath_pr_out’:
    scsi/qemu-pr-helper.c:523:32: error: array subscript <unknown> is outside array bounds of ‘struct transportid *[0]’ [-Werror=array-bounds]
      523 |             paramp.trnptid_list[paramp.num_transportid++] = id;
          |             ~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~
    In file included from scsi/qemu-pr-helper.c:36:
    /usr/include/mpath_persist.h:168:22: note: while referencing ‘trnptid_list’
      168 |  struct transportid *trnptid_list[];
          |                      ^~~~~~~~~~~~
    scsi/qemu-pr-helper.c:424:35: note: defined here ‘paramp’
      424 |     struct prout_param_descriptor paramp;
          |                                   ^~~~~~
    
    This highlights an actual implementation issue in function multipath_pr_out.
    The variable paramp is declared with type `struct prout_param_descriptor`,
    which is a struct terminated by an empty array in mpath_persist.h:
    
            struct transportid *trnptid_list[];
    
    That empty array was filled with code that looked like that:
    
            trnptid_list[paramp.descr.num_transportid++] = id;
    
    This is an actual out-of-bounds access.
    
    The fix is to malloc `paramp`.
    
    Signed-off-by: default avatarChristophe de Dinechin <dinechin@redhat.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    4ce1e15f
    scsi/qemu-pr-helper: Fix out-of-bounds access to trnptid_list[]
    Christophe de Dinechin authored
    
    
    Compile error reported by gcc 10.0.1:
    
    scsi/qemu-pr-helper.c: In function ‘multipath_pr_out’:
    scsi/qemu-pr-helper.c:523:32: error: array subscript <unknown> is outside array bounds of ‘struct transportid *[0]’ [-Werror=array-bounds]
      523 |             paramp.trnptid_list[paramp.num_transportid++] = id;
          |             ~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~
    In file included from scsi/qemu-pr-helper.c:36:
    /usr/include/mpath_persist.h:168:22: note: while referencing ‘trnptid_list’
      168 |  struct transportid *trnptid_list[];
          |                      ^~~~~~~~~~~~
    scsi/qemu-pr-helper.c:424:35: note: defined here ‘paramp’
      424 |     struct prout_param_descriptor paramp;
          |                                   ^~~~~~
    
    This highlights an actual implementation issue in function multipath_pr_out.
    The variable paramp is declared with type `struct prout_param_descriptor`,
    which is a struct terminated by an empty array in mpath_persist.h:
    
            struct transportid *trnptid_list[];
    
    That empty array was filled with code that looked like that:
    
            trnptid_list[paramp.descr.num_transportid++] = id;
    
    This is an actual out-of-bounds access.
    
    The fix is to malloc `paramp`.
    
    Signed-off-by: default avatarChristophe de Dinechin <dinechin@redhat.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Loading