usb: sanity check setup_index+setup_len in post_load
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
parent
94c2b6aff4
commit
c60174e847
@ -47,6 +47,10 @@ static int usb_device_post_load(void *opaque, int version_id)
|
|||||||
} else {
|
} else {
|
||||||
dev->attached = 1;
|
dev->attached = 1;
|
||||||
}
|
}
|
||||||
|
if (dev->setup_index >= sizeof(dev->data_buf) ||
|
||||||
|
dev->setup_len >= sizeof(dev->data_buf)) {
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user