qemu-2.7.0-CVE-2016-7157-2.patch

From: Prasad J Pandit <address@hidden>

When LSI SAS1068 Host Bus emulator builds configuration page
headers, mptsas_config_pack() asserts to check returned size
value is within limit of 256 bytes. Fix that assert expression.

Suggested-by: Paolo Bonzini <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
---
 hw/scsi/mptconfig.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/scsi/mptconfig.c b/hw/scsi/mptconfig.c
index 1ec895b..531947f 100644
--- a/hw/scsi/mptconfig.c
+++ b/hw/scsi/mptconfig.c
@@ -158,7 +158,7 @@ static size_t mptsas_config_pack(uint8_t **data, const char *fmt, ...)
     va_end(ap);
 
     if (data) {
-        assert(ret < 256 && (ret % 4) == 0);
+        assert(ret / 4 < 256);
         stb_p(*data + 1, ret / 4);
     }
     return ret;
-- 
2.5.5