esp: check command buffer length before write(CVE-2016-4439)

esp: check command buffer length before write(CVE-2016-4439)

The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte
FIFO buffer. It is used to handle command and data transfer. While
writing to this command buffer 's->cmdbuf[TI_BUFSZ=16]', a check
was missing to validate input length. Add check to avoid OOB write
access.

Fixes CVE-2016-4439.

Reported-by: Li Qiang <[email protected]>
Cc: [email protected]
Signed-off-by: Prasad J Pandit <[email protected]>
Message-Id: <1463654371[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>