Commit 1439b9c1 authored by Fam Zheng's avatar Fam Zheng Committed by Kevin Wolf
Browse files

iscsi: Don't blindly use designator length in response for memcpy 



Per SCSI definition the designator_length we receive from INQUIRY is 8,
12 or at most 16, but we should be careful because the remote iscsi
target may misbehave, otherwise we could have a buffer overflow.

Reported-by: default avatarMax Reitz <mreitz@redhat.com>
Signed-off-by: default avatarFam Zheng <famz@redhat.com>
Signed-off-by: default avatarKevin Wolf <kwolf@redhat.com>
parent e06f4639

block/iscsi.c

+1 −1
Original line number Diff line number Diff line
@@ -2226,7 +2226,7 @@ static void iscsi_populate_target_desc(unsigned char *desc, IscsiLun *lun) 
    desc[5] = (dd->designator_type & 0xF)

        | ((dd->association & 3) << 4);

    desc[7] = dd->designator_length;

    memcpy(desc + 8, dd->designator, dd->designator_length);

    memcpy(desc + 8, dd->designator, MIN(dd->designator_length, 20));



    desc[28] = 0;

    desc[29] = (lun->block_size >> 16) & 0xFF;