[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 08/14] usb: control buffer fixes
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PATCH 08/14] usb: control buffer fixes |
Date: |
Wed, 4 May 2011 17:41:42 +0200 |
From: Hans de Goede <address@hidden>
Windows allows control transfers to pass up to 4k of data, so raise our
control buffer size to 4k. For control out transfers the usb core code copies
the control request data to a buffer before calling the device's handle_control
callback. Add a check for overflowing the buffer before copying the data.
Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
---
hw/usb.c | 6 ++++++
hw/usb.h | 2 +-
2 files changed, 7 insertions(+), 1 deletions(-)
diff --git a/hw/usb.c b/hw/usb.c
index 82a6217..d8c0a75 100644
--- a/hw/usb.c
+++ b/hw/usb.c
@@ -93,6 +93,12 @@ static int do_token_setup(USBDevice *s, USBPacket *p)
s->setup_len = ret;
s->setup_state = SETUP_STATE_DATA;
} else {
+ if (s->setup_len > sizeof(s->data_buf)) {
+ fprintf(stderr,
+ "usb_generic_handle_packet: ctrl buffer too small (%d >
%zu)\n",
+ s->setup_len, sizeof(s->data_buf));
+ return USB_RET_STALL;
+ }
if (s->setup_len == 0)
s->setup_state = SETUP_STATE_ACK;
else
diff --git a/hw/usb.h b/hw/usb.h
index d3d755d..22bb338 100644
--- a/hw/usb.h
+++ b/hw/usb.h
@@ -167,7 +167,7 @@ struct USBDevice {
int32_t state;
uint8_t setup_buf[8];
- uint8_t data_buf[1024];
+ uint8_t data_buf[4096];
int32_t remote_wakeup;
int32_t setup_state;
int32_t setup_len;
--
1.7.1
- [Qemu-devel] [PULL] usb patch queue, Gerd Hoffmann, 2011/05/04
- [Qemu-devel] [PATCH 01/14] usb-linux: introduce a usb_linux_alt_setting function, Gerd Hoffmann, 2011/05/04
- [Qemu-devel] [PATCH 02/14] usb-linux: Get the alt. setting from sysfs rather then asking the dev, Gerd Hoffmann, 2011/05/04
- [Qemu-devel] [PATCH 07/14] usb-linux: Add support for buffering iso out usb packets, Gerd Hoffmann, 2011/05/04
- [Qemu-devel] [PATCH 03/14] usb-linux: Add support for buffering iso usb packets, Gerd Hoffmann, 2011/05/04
- [Qemu-devel] [PATCH 11/14] ohci: get ohci state via container_of(), Gerd Hoffmann, 2011/05/04
- [Qemu-devel] [PATCH 06/14] usb-linux: We only need to keep track of 15 endpoints, Gerd Hoffmann, 2011/05/04
- [Qemu-devel] [PATCH 04/14] usb-linux: Refuse packets for endpoints which are not in the usb descriptor, Gerd Hoffmann, 2011/05/04
- [Qemu-devel] [PATCH 05/14] usb-linux: Refuse iso packets when max packet size is 0 (alt setting 0), Gerd Hoffmann, 2011/05/04
- [Qemu-devel] [PATCH 10/14] uhci: keep uhci state pointer in async packet struct., Gerd Hoffmann, 2011/05/04
- [Qemu-devel] [PATCH 08/14] usb: control buffer fixes,
Gerd Hoffmann <=
- [Qemu-devel] [PATCH 12/14] musb: get musb state via container_of(), Gerd Hoffmann, 2011/05/04
- [Qemu-devel] [PATCH 14/14] usb: mass storage fix, Gerd Hoffmann, 2011/05/04
- [Qemu-devel] [PATCH 13/14] usb: move complete callback to port ops, Gerd Hoffmann, 2011/05/04
- [Qemu-devel] [PATCH 09/14] uhci: switch to QTAILQ, Gerd Hoffmann, 2011/05/04
- Re: [Qemu-devel] [PULL] usb patch queue, Anthony Liguori, 2011/05/05