REDHAT-BUG-2488283: Medium severity Qemu Qemu vulnerability

QEMU's virtio-blk device can write past the end of a heap-allocated MMIO bounce buffer while handling a crafted VIRTIOBLKTSCSICMD request. A malicious guest that can program virtio-blk request descriptors can make the second-to-last writable input descriptor point to an MMIO guest physical address with a length of only 1 byte. QEMU maps that descriptor through an exact-size heap bounce buffer, then virtioblkhandlescsi() writes the 4-byte virtioscsiinhdr.errors field without first checking that the descriptor is large enough. A malicious guest can cause an out-of-bounds host heap write in the QEMU process by submitting a malformed virtio-blk SCSI request.