[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 2/2] usb: deal with potential Null pointer returned
From: |
Liam Merwick |
Subject: |
[Qemu-devel] [PATCH 2/2] usb: deal with potential Null pointer returned by usb_ep_get() |
Date: |
Wed, 30 Jan 2019 14:37:02 +0000 |
From: Liam Merwick <address@hidden>
usb_ep_get() can return a Null pointer in the (albeit unlikely) case
that a NULL USBDevice is passed in via the 'dev' parameter. Before
dereferencing the return value from usb_ep_get(), check its validity
and use a default (invalid) value where needed.
Reported by the Parfait static code analysis tool
Signed-off-by: Liam Merwick <address@hidden>
Reviewed-by: Darren Kenny <address@hidden>
Reviewed-by: Mark Kanda <address@hidden>
Reviewed-by: Ameya More <address@hidden>
---
hw/usb/core.c | 26 ++++++++++++++++++++++----
1 file changed, 22 insertions(+), 4 deletions(-)
diff --git a/hw/usb/core.c b/hw/usb/core.c
index 1aa0051b2b2d..9d46a4b41e99 100644
--- a/hw/usb/core.c
+++ b/hw/usb/core.c
@@ -733,19 +733,23 @@ struct USBEndpoint *usb_ep_get(USBDevice *dev, int pid,
int ep)
uint8_t usb_ep_get_type(USBDevice *dev, int pid, int ep)
{
struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
- return uep->type;
+ return uep ? uep->type : USB_ENDPOINT_XFER_INVALID;
}
void usb_ep_set_type(USBDevice *dev, int pid, int ep, uint8_t type)
{
struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
- uep->type = type;
+ if (uep) {
+ uep->type = type;
+ }
}
void usb_ep_set_ifnum(USBDevice *dev, int pid, int ep, uint8_t ifnum)
{
struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
- uep->ifnum = ifnum;
+ if (uep) {
+ uep->ifnum = ifnum;
+ }
}
void usb_ep_set_max_packet_size(USBDevice *dev, int pid, int ep,
@@ -754,6 +758,10 @@ void usb_ep_set_max_packet_size(USBDevice *dev, int pid,
int ep,
struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
int size, microframes;
+ if (!uep) {
+ return;
+ }
+
size = raw & 0x7ff;
switch ((raw >> 11) & 3) {
case 1:
@@ -774,6 +782,10 @@ void usb_ep_set_max_streams(USBDevice *dev, int pid, int
ep, uint8_t raw)
struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
int MaxStreams;
+ if (!uep) {
+ return;
+ }
+
MaxStreams = raw & 0x1f;
if (MaxStreams) {
uep->max_streams = 1 << MaxStreams;
@@ -785,7 +797,9 @@ void usb_ep_set_max_streams(USBDevice *dev, int pid, int
ep, uint8_t raw)
void usb_ep_set_halted(USBDevice *dev, int pid, int ep, bool halted)
{
struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
- uep->halted = halted;
+ if (uep) {
+ uep->halted = halted;
+ }
}
USBPacket *usb_ep_find_packet_by_id(USBDevice *dev, int pid, int ep,
@@ -794,6 +808,10 @@ USBPacket *usb_ep_find_packet_by_id(USBDevice *dev, int
pid, int ep,
struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
USBPacket *p;
+ if (!uep) {
+ return NULL;
+ }
+
QTAILQ_FOREACH(p, &uep->queue, queue) {
if (p->id == id) {
return p;
--
1.8.3.1