tree 401c2c4cdb589d8e17130f80296b5f5f58efa143
parent 915976bd98a9286efe6f2e573cb4f1360603adf9
author Paolo Bonzini <pbonzini@redhat.com> 1606824566 +0100
committer Peter Maydell <peter.maydell@linaro.org> 1606836185 +0000

ide: atapi: assert that the buffer pointer is in range

A case was reported where s->io_buffer_index can be out of range.
The report skimped on the details but it seems to be triggered
by s->lba == -1 on the READ/READ CD paths (e.g. by sending an
ATAPI command with LBA = 0xFFFFFFFF).  For now paper over it
with assertions.  The first one ensures that there is no overflow
when incrementing s->io_buffer_index, the second checks for the
buffer overrun.

Note that the buffer overrun is only a read, so I am not sure
if the assertion failure is actually less harmful than the overrun.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20201201120926.56559-1-pbonzini@redhat.com
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>