Re: [PATCH v2] hw/scsi/scsi-disk: Fix out of bounds access in mode_sense_page()

[Paolo Bonzini]

On 04/02/21 23:50, Philippe Mathieu-Daudé wrote:
diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index ed52fcd49ff..93aec483e88 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -1089,7 +1089,7 @@ static int scsi_emulate_mechanism_status(SCSIDiskState 
*s, uint8_t *outbuf)
  static int mode_sense_page(SCSIDiskState *s, int page, uint8_t **p_outbuf,
                             int page_control)
  {
-    static const int mode_sense_valid[0x3f] = {
+    static const int mode_sense_valid[MODE_PAGE_ALLS + 1] = {
          [MODE_PAGE_HD_GEOMETRY]            = (1 << TYPE_DISK),
          [MODE_PAGE_FLEXIBLE_DISK_GEOMETRY] = (1 << TYPE_DISK),
          [MODE_PAGE_CACHING]                = (1 << TYPE_DISK) | (1 << 
TYPE_ROM),

The bug is really that mode select with page 0x3f should fail, but it's 
okay too.  Can you also write a testcase along the lines of 
test_unaligned_write_same?

Paolo