mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

usb: control buffer fixes

Browse Source 
Windows allows control transfers to pass up to 4k of data, so raise our
control buffer size to 4k. For control out transfers the usb core code copies
the control request data to a buffer before calling the device's handle_control
callback. Add a check for overflowing the buffer before copying the data.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
This commit is contained in:
Hans de Goede 2011-02-02 17:46:00 +01:00 committed by Gerd Hoffmann
parent bb6d5498c6
commit 19f3322379
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hw/usb.c
View File

@ -93,6 +93,12 @@ static int do_token_setup(USBDevice *s, USBPacket *p)
s->setup_len = ret; s->setup_len = ret;
s->setup_state = SETUP_STATE_DATA; s->setup_state = SETUP_STATE_DATA;
} else { } else {
if (s->setup_len > sizeof(s->data_buf)) {
fprintf(stderr,
"usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n",
s->setup_len, sizeof(s->data_buf));
return USB_RET_STALL;
}
if (s->setup_len == 0) if (s->setup_len == 0)
s->setup_state = SETUP_STATE_ACK; s->setup_state = SETUP_STATE_ACK;
else else

2
hw/usb.h
View File

@ -167,7 +167,7 @@ struct USBDevice {
int32_t state; int32_t state;
uint8_t setup_buf[8]; uint8_t setup_buf[8];
uint8_t data_buf[1024]; uint8_t data_buf[4096];
int32_t remote_wakeup; int32_t remote_wakeup;
int32_t setup_state; int32_t setup_state;
int32_t setup_len; int32_t setup_len;