[Qemu-commits] [qemu/qemu] 813212: ide: atapi: assert that the buffer pointer is in r...

[Paolo Bonzini]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 813212288970c39b1800f63e83ac6e96588095c6
      
https://github.com/qemu/qemu/commit/813212288970c39b1800f63e83ac6e96588095c6
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2020-12-01 (Tue, 01 Dec 2020)

  Changed paths:
    M hw/ide/atapi.c

  Log Message:
  -----------
  ide: atapi: assert that the buffer pointer is in range

A case was reported where s->io_buffer_index can be out of range.
The report skimped on the details but it seems to be triggered
by s->lba == -1 on the READ/READ CD paths (e.g. by sending an
ATAPI command with LBA = 0xFFFFFFFF).  For now paper over it
with assertions.  The first one ensures that there is no overflow
when incrementing s->io_buffer_index, the second checks for the
buffer overrun.

Note that the buffer overrun is only a read, so I am not sure
if the assertion failure is actually less harmful than the overrun.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20201201120926.56559-1-pbonzini@redhat.com
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>