admin/libiscsi
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

lib/scsi-lowlevel: Make the REPORT LUNS unmarshalling code more flexible

Browse Source 
Instead of rejecting REPORT LUNS responses if the data buffer size exceeds
the LUN list size, truncate the data buffer.

Fixes: https://github.com/sahlberg/libiscsi/issues/385
This commit is contained in:
Bart Van Assche
2022-09-04 14:36:18 -07:00
parent 1017435ca9
commit 51df0d0512
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
lib/scsi-lowlevel.c
View File

@@ -490,9 +490,8 @@ scsi_reportluns_datain_unmarshall(struct scsi_task *task)
} }
list_size = task_get_uint32(task, 0) + 8; list_size = task_get_uint32(task, 0) + 8;
if (list_size < task->datain.size) { if (list_size > task->datain.size)
return NULL; list_size = task->datain.size;
}
num_luns = list_size / 8 - 1; num_luns = list_size / 8 - 1;
list = scsi_malloc(task, offsetof(struct scsi_reportluns_list, luns) list = scsi_malloc(task, offsetof(struct scsi_reportluns_list, luns)