This patch add validation checks on FIFO structures in esp_post_load() to
avoid assertion error `assert(fifo->num < fifo->capacity);` in fifo8_push(),
which can occur if the inbound migration stream is malformed. By performing
these checks during post-load, we can catch and handle such issues earlier,
avoiding crashes due to corrupted state.
Signed-off-by: Zheng Huang <hz1624917...@gmail.com>
---
hw/scsi/esp.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index ac841dc32e..ba77017087 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -1350,11 +1350,17 @@ static int esp_post_load(void *opaque, int version_id)
/* Migrate ti_buf to fifo */
len = s->mig_ti_wptr - s->mig_ti_rptr;
for (i = 0; i < len; i++) {
+ if (&s->fifo.num >= &s->fifo.capacity) {
+ return -1;
+ }
fifo8_push(&s->fifo, s->mig_ti_buf[i]);
}
/* Migrate cmdbuf to cmdfifo */
for (i = 0; i < s->mig_cmdlen; i++) {
+ if (&s->cmdfifo.num >= &s->cmdfifo.capacity) {
+ return -1;
+ }
fifo8_push(&s->cmdfifo, s->mig_cmdbuf[i]);
}
}
--
2.34.1
