gentoo/app-emulation/qemu/files/qemu-2.7.0-CVE-2016-7157-2.patch

28 lines
812 B
Diff

From: Prasad J Pandit <address@hidden>
When LSI SAS1068 Host Bus emulator builds configuration page
headers, mptsas_config_pack() asserts to check returned size
value is within limit of 256 bytes. Fix that assert expression.
Suggested-by: Paolo Bonzini <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
---
hw/scsi/mptconfig.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/scsi/mptconfig.c b/hw/scsi/mptconfig.c
index 1ec895b..531947f 100644
--- a/hw/scsi/mptconfig.c
+++ b/hw/scsi/mptconfig.c
@@ -158,7 +158,7 @@ static size_t mptsas_config_pack(uint8_t **data, const char *fmt, ...)
va_end(ap);
if (data) {
- assert(ret < 256 && (ret % 4) == 0);
+ assert(ret / 4 < 256);
stb_p(*data + 1, ret / 4);
}
return ret;
--
2.5.5