[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 09/10] usb: mtp: fix possible buffer overflow
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 09/10] usb: mtp: fix possible buffer overflow |
Date: |
Mon, 5 May 2014 13:12:38 +0200 |
Signed-off-by: Gerd Hoffmann <address@hidden>
Reviewed-by: Peter Wu <address@hidden>
Reviewed-by: Stefan Hajnoczi <address@hidden>
---
hw/usb/dev-mtp.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index b6eaeae..62428d8 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -998,6 +998,14 @@ static void usb_mtp_handle_data(USBDevice *dev, USBPacket
*p)
cmd.argc = (le32_to_cpu(container.length) - sizeof(container))
/ sizeof(uint32_t);
cmd.trans = le32_to_cpu(container.trans);
+ if (cmd.argc > ARRAY_SIZE(cmd.argv)) {
+ cmd.argc = ARRAY_SIZE(cmd.argv);
+ }
+ if (p->iov.size < sizeof(container) + cmd.argc * sizeof(uint32_t))
{
+ trace_usb_mtp_stall(s->dev.addr, "packet too small");
+ p->status = USB_RET_STALL;
+ return;
+ }
usb_packet_copy(p, ¶ms, cmd.argc * sizeof(uint32_t));
for (i = 0; i < cmd.argc; i++) {
cmd.argv[i] = le32_to_cpu(params[i]);
--
1.8.3.1
- [Qemu-devel] [PULL 00/10] usb patch queue, Gerd Hoffmann, 2014/05/05
- [Qemu-devel] [PULL 02/10] usb: mtp: replace debug printfs with trace points, Gerd Hoffmann, 2014/05/05
- [Qemu-devel] [PULL 06/10] usb: mtp: fix error path memory leak, Gerd Hoffmann, 2014/05/05
- [Qemu-devel] [PULL 01/10] usb-ohci: Add vmstate descriptor, Gerd Hoffmann, 2014/05/05
- [Qemu-devel] [PULL 03/10] usb: mtp: fix usb_mtp_add_u64, Gerd Hoffmann, 2014/05/05
- [Qemu-devel] [PULL 07/10] usb: mtp: avoid empty description string, Gerd Hoffmann, 2014/05/05
- [Qemu-devel] [PULL 09/10] usb: mtp: fix possible buffer overflow,
Gerd Hoffmann <=
- [Qemu-devel] [PULL 08/10] usb: mtp: drop data-out hexdump, Gerd Hoffmann, 2014/05/05
- [Qemu-devel] [PULL 04/10] usb: mtp: fix version (is decimal not bcd), Gerd Hoffmann, 2014/05/05
- [Qemu-devel] [PULL 10/10] usb: mtp: reply INCOMPLETE_TRANSFER on read errors, Gerd Hoffmann, 2014/05/05
- [Qemu-devel] [PULL 05/10] usb: mtp: fix serial (must be exact 32 chars), Gerd Hoffmann, 2014/05/05
- Re: [Qemu-devel] [PULL 00/10] usb patch queue, Peter Maydell, 2014/05/07