Vmware Paravirtual SCSI emulation uses command descriptors to
process SCSI commands. These descriptors come with their ring
buffers. A guest could set the ring buffer size to an arbitrary
value leading to OOB access issue. Add check to avoid it.
Reported-by: NLi Qiang <liqiang6-s@360.cn>
Signed-off-by: NPrasad J Pandit <pjp@fedoraproject.org>
Cc: qemu-stable@nongnu.org
Message-Id: <1464000485-27041-1-git-send-email-ppandit@redhat.com>
Reviewed-by: NShmulik Ladkani <shmulik.ladkani@ravellosystems.com>
Reviewed-by: NDmitry Fleytman <dmitry@daynix.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>