[Qemu-commits] [qemu/qemu] fac080: ide: atapi: assert that the buffer pointer is in r...

[Paolo Bonzini]

  Branch: refs/heads/staging
  Home:   https://github.com/qemu/qemu
  Commit: fac080f5a75d82d0c5ff12950ebd2bb01132581e
      
https://github.com/qemu/qemu/commit/fac080f5a75d82d0c5ff12950ebd2bb01132581e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2020-12-01 (Tue, 01 Dec 2020)

  Changed paths:
    M hw/ide/atapi.c

  Log Message:
  -----------
  ide: atapi: assert that the buffer pointer is in range

A case was reported where s->io_buffer_index can be out of range.
The report skimped on the details but it seems to be triggered
by s->lba == -1 on the READ/READ CD paths (e.g. by sending an
ATAPI command with LBA = 0xFFFFFFFF).  For now paper over it
with assertions.  The first one ensures that there is no overflow
when incrementing s->io_buffer_index, the second checks for the
buffer overrun.

Note that the buffer overrun is only a read, so I am not sure
if the assertion failure is actually less harmful than the overrun.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20201201120926.56559-1-pbonzini@redhat.com