Changeset 104170 in vbox for trunk/src/VBox/Devices

Timestamp:

Apr 5, 2024 8:53:01 AM (10 months ago)

Author:

vboxsync

Message:

Devices/LsiLogicSCSI: Respond with a device not there error if the CDB length for a SCSI I/O request is invalid, bugref:10613

File:

• trunk/src/VBox/Devices/Storage/DevLsiLogicSCSI.cpp (modified) (2 diffs)

trunk/src/VBox/Devices/Storage/DevLsiLogicSCSI.cpp

@@ -2296 +2296 @@
         PLSILOGICDEVICE pTgtDev = &pThisCC->paDeviceStates[pGuestReq->SCSIIO.u8TargetID];
 
-        if (pTgtDev->pDrvBase)
+        if (   pTgtDev->pDrvBase
+            && pGuestReq->SCSIIO.u8CDBLength <= RT_ELEMENTS(pGuestReq->SCSIIO.au8CDB))
         {
             /* Allocate and prepare a new request. */
@@ -2365 +2366 @@
     if (g_cLogged++ < MAX_REL_LOG_ERRORS)
     {
-        LogRel(("LsiLogic#%d: %d/%d (Bus/Target) doesn't exist\n", pDevIns->iInstance,
-                pGuestReq->SCSIIO.u8TargetID, pGuestReq->SCSIIO.u8Bus));
+        LogRel(("LsiLogic#%d: %d/%d/%d (Bus/Target/CDBLength) doesn't exist\n", pDevIns->iInstance,
+                pGuestReq->SCSIIO.u8TargetID, pGuestReq->SCSIIO.u8Bus, pGuestReq->SCSIIO.u8CDBLength));
         /* Log the CDB too  */
         LogRel(("LsiLogic#%d: Guest issued CDB {%#x",
                 pDevIns->iInstance, pGuestReq->SCSIIO.au8CDB[0]));
-        for (unsigned i = 1; i < pGuestReq->SCSIIO.u8CDBLength; i++)
+        for (unsigned i = 1; i < RT_MIN(pGuestReq->SCSIIO.u8CDBLength, RT_ELEMENTS(pGuestReq->SCSIIO.au8CDB)); i++)
             LogRel((", %#x", pGuestReq->SCSIIO.au8CDB[i]));
         LogRel(("}\n"));