Changeset 104221 in vbox for trunk/src/VBox/Devices/Storage/VSCSI/VSCSIDevice.cpp

Timestamp:

Apr 8, 2024 10:18:11 AM (8 months ago)

Author:

vboxsync

Message:

Devices/Storage/VSCSI: Be more strict when it comes to CDB lengths for individual commands, bugref:10613

File:

• trunk/src/VBox/Devices/Storage/VSCSI/VSCSIDevice.cpp (modified) (5 diffs)

trunk/src/VBox/Devices/Storage/VSCSI/VSCSIDevice.cpp

@@ -70 +70 @@
     LogFlowFunc(("CDB: %.*Rhxs Cmd: %s\n", pVScsiReq->cbCDB, pVScsiReq->pbCDB, SCSICmdText(pVScsiReq->pbCDB[0])));
 
+    if (!pVScsiReq->cbCDB)
+    {
+        *prcReq = vscsiReqSenseErrorSet(&pVScsiDevice->VScsiSense, pVScsiReq, SCSI_SENSE_ILLEGAL_REQUEST,
+                                        SCSI_ASC_ILLEGAL_OPCODE, 0x00);
+        return true;
+    }
+
     switch (pVScsiReq->pbCDB[0])
     {
@@ -95 +102 @@
         case SCSI_REPORT_LUNS:
         {
+            if (pVScsiReq->cbCDB < 10)
+            {
+                *prcReq = vscsiReqSenseErrorSet(&pVScsiDevice->VScsiSense, pVScsiReq, SCSI_SENSE_ILLEGAL_REQUEST,
+                                                SCSI_ASC_ILLEGAL_OPCODE, 0x00);
+                break;
+            }
+
             /*
              * If allocation length is less than 16 bytes SPC compliant devices have
@@ -130 +144 @@
         case SCSI_REQUEST_SENSE:
         {
+            if (pVScsiReq->cbCDB < 5)
+            {
+                *prcReq = vscsiReqSenseErrorSet(&pVScsiDevice->VScsiSense, pVScsiReq, SCSI_SENSE_ILLEGAL_REQUEST,
+                                                SCSI_ASC_ILLEGAL_OPCODE, 0x00);
+                break;
+            }
+
             vscsiReqSetXferDir(pVScsiReq, VSCSIXFERDIR_T2I);
             vscsiReqSetXferSize(pVScsiReq, pVScsiReq->pbCDB[4]);
@@ -143 +164 @@
         case SCSI_MAINTENANCE_IN:
         {
+            if (pVScsiReq->cbCDB < 8)
+            {
+                *prcReq = vscsiLunReqSenseErrorSet(pVScsiLun, pVScsiReq, SCSI_SENSE_ILLEGAL_REQUEST,
+                                                   SCSI_ASC_ILLEGAL_OPCODE, 0x00);
+                break;
+            }
+
             if (pVScsiReq->pbCDB[1] == SCSI_MAINTENANCE_IN_REPORT_SUPP_OPC)
             {
@@ -377 +405 @@
         {
             PVSCSILUNINT pVScsiLun = pVScsiDevice->papVScsiLun[pVScsiReq->iLun];
-            rc = pVScsiLun->pVScsiLunDesc->pfnVScsiLunReqProcess(pVScsiLun, pVScsiReq);
+            PVSCSILUNDESC pVScsiLunDesc = pVScsiLun->pVScsiLunDesc;
+            uint8_t const bOpc = pVScsiReq->pbCDB[0];
+            uint8_t const cbCdbMin = pVScsiLunDesc->pacbCdbOpc[bOpc];
+
+            /* Fail if the opcode is not supported or the CDB is too short. */
+            if (   cbCdbMin != VSCSI_LUN_CDB_SZ_INVALID
+                && pVScsiReq->cbCDB >= cbCdbMin)
+                rc = pVScsiLunDesc->pfnVScsiLunReqProcess(pVScsiLun, pVScsiReq);
+            else
+            {
+                /*
+                 * CDB length is smaller than what the LUN expects, respond with an
+                 * ILLEGAL OPCODE error.
+                 */
+                vscsiLunReqSenseErrorSet(pVScsiLun, pVScsiReq, SCSI_SENSE_ILLEGAL_REQUEST,
+                                         SCSI_ASC_ILLEGAL_OPCODE, 0x00);
+
+                vscsiDeviceReqComplete(pVScsiDevice, pVScsiReq,
+                                       SCSI_STATUS_CHECK_CONDITION, false, VINF_SUCCESS);
+            }
         }
         else