mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

usb: mtp: fix possible buffer overflow

Browse Source 
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
Gerd Hoffmann 2014-04-25 12:05:15 +02:00
parent 9cd04ccf75
commit afa82daf16
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
hw/usb/dev-mtp.c
View File

@ -998,6 +998,14 @@ static void usb_mtp_handle_data(USBDevice *dev, USBPacket *p)
cmd.argc = (le32_to_cpu(container.length) - sizeof(container))
/ sizeof(uint32_t);
cmd.trans = le32_to_cpu(container.trans);
if (cmd.argc > ARRAY_SIZE(cmd.argv)) {
cmd.argc = ARRAY_SIZE(cmd.argv);
}
if (p->iov.size < sizeof(container) + cmd.argc * sizeof(uint32_t)) {
trace_usb_mtp_stall(s->dev.addr, "packet too small");
p->status = USB_RET_STALL;
return;
}
usb_packet_copy(p, &params, cmd.argc * sizeof(uint32_t));
for (i = 0; i < cmd.argc; i++) {
cmd.argv[i] = le32_to_cpu(params[i]);