[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 1/2] usb: mtp: fix possible buffer overflow
From: |
Peter Wu |
Subject: |
Re: [Qemu-devel] [PATCH 1/2] usb: mtp: fix possible buffer overflow |
Date: |
Tue, 29 Apr 2014 12:33:57 +0200 |
User-agent: |
KMail/4.13 (Linux/3.15.0-rc2-custom-00205-g9a60ee1; KDE/4.13.0; x86_64; ; ) |
On Tuesday 29 April 2014 10:43:51 Gerd Hoffmann wrote:
> Signed-off-by: Gerd Hoffmann <address@hidden>
Reviewed-by: Peter Wu <address@hidden>
> ---
> hw/usb/dev-mtp.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
> index b6eaeae..62428d8 100644
> --- a/hw/usb/dev-mtp.c
> +++ b/hw/usb/dev-mtp.c
> @@ -998,6 +998,14 @@ static void usb_mtp_handle_data(USBDevice *dev,
> USBPacket *p)
> cmd.argc = (le32_to_cpu(container.length) - sizeof(container))
> / sizeof(uint32_t);
> cmd.trans = le32_to_cpu(container.trans);
> + if (cmd.argc > ARRAY_SIZE(cmd.argv)) {
> + cmd.argc = ARRAY_SIZE(cmd.argv);
> + }
> + if (p->iov.size < sizeof(container) + cmd.argc *
> sizeof(uint32_t)) {
> + trace_usb_mtp_stall(s->dev.addr, "packet too small");
> + p->status = USB_RET_STALL;
> + return;
> + }
> usb_packet_copy(p, ¶ms, cmd.argc * sizeof(uint32_t));
> for (i = 0; i < cmd.argc; i++) {
> cmd.argv[i] = le32_to_cpu(params[i]);
>