Code:  pvscsi_convert_sglist(PVSCSIRequest *r)
 {
    int chunk_size;
     uint64_t data_length = r->req.dataLen;
     PVSCSISGState sg = r->sg;
    while (data_length) {
        while (!sg.resid) {
             pvscsi_get_next_sg_elem(&sg);
             trace_pvscsi_convert_sglist(r->req.context, r->sg.dataAddr,
                                         r->sg.resid);
         }
        assert(data_length > 0);
        chunk_size = MIN((unsigned) data_length, sg.resid);
         if (chunk_size) {
             qemu_sglist_add(&r->sgl, sg.dataAddr, chunk_size);
         }
        sg.dataAddr += chunk_size;
        data_length -= chunk_size;
        sg.resid -= chunk_size;
    }
}

Vulnerability Type: DoS
CWE ID: CWE-399
Summary: The pvscsi_convert_sglist function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging an incorrect cast.
Commit Message: 