megasas: use unsigned type for reply_queue_head and check index

megasas: use unsigned type for reply_queue_head and check index

A guest user may set 'reply_queue_head' field of MegasasState to
a negative value. Later in 'megasas_lookup_frame' it is used to
index into s->frames[] array. Use unsigned type to avoid OOB
access issue.

Also check that 'index' value stays within s->frames[] bounds
through the while() loop in 'megasas_lookup_frame' to avoid OOB
access.

Reported-by: Ren Ding <[email protected]>
Reported-by: Hanqing Zhao <[email protected]>
Reported-by: Alexander Bulekov <[email protected]>
Signed-off-by: Prasad J Pandit <[email protected]>
Acked-by: Alexander Bulekov <[email protected]>
Message-Id: <20200513192540.1583887[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>