[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 8/9] usb: ccid: check ccid apdu length
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 8/9] usb: ccid: check ccid apdu length |
Date: |
Mon, 6 Feb 2017 12:28:20 +0100 |
From: Prasad J Pandit <address@hidden>
CCID device emulator uses Application Protocol Data Units(APDU)
to exchange command and responses to and from the host.
The length in these units couldn't be greater than 65536. Add
check to ensure the same. It'd also avoid potential integer
overflow in emulated_apdu_from_guest.
Reported-by: Li Qiang <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>
---
hw/usb/dev-smartcard-reader.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index 89e11b6..1325ea1 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -967,7 +967,7 @@ static void ccid_on_apdu_from_guest(USBCCIDState *s,
CCID_XferBlock *recv)
DPRINTF(s, 1, "%s: seq %d, len %d\n", __func__,
recv->hdr.bSeq, len);
ccid_add_pending_answer(s, (CCID_Header *)recv);
- if (s->card) {
+ if (s->card && len <= BULK_OUT_DATA_SIZE) {
ccid_card_apdu_from_guest(s->card, recv->abData, len);
} else {
DPRINTF(s, D_WARN, "warning: discarded apdu\n");
--
1.8.3.1
- [Qemu-devel] [PULL 0/9] usb: various bugfixes, mostly xhci., Gerd Hoffmann, 2017/02/06
- [Qemu-devel] [PULL 8/9] usb: ccid: check ccid apdu length,
Gerd Hoffmann <=
- [Qemu-devel] [PULL 3/9] usb: accept usb3 control requests, Gerd Hoffmann, 2017/02/06
- [Qemu-devel] [PULL 4/9] xhci: only free completed transfers, Gerd Hoffmann, 2017/02/06
- [Qemu-devel] [PULL 1/9] hw/usb/dev-hid: Improve guest compatibility of usb-tablet, Gerd Hoffmann, 2017/02/06
- [Qemu-devel] [PULL 7/9] xhci: guard xhci_kick_epctx against recursive calls, Gerd Hoffmann, 2017/02/06
- [Qemu-devel] [PULL 5/9] xhci: rename xhci_complete_packet to xhci_try_complete_packet, Gerd Hoffmann, 2017/02/06
- [Qemu-devel] [PULL 6/9] xhci: don't kick in xhci_submit and xhci_fire_ctl_transfer, Gerd Hoffmann, 2017/02/06
- [Qemu-devel] [PULL 2/9] usb/uas: more verbose error message, Gerd Hoffmann, 2017/02/06
- [Qemu-devel] [PULL 9/9] xhci: fix event queue IRQ handling, Gerd Hoffmann, 2017/02/06
- Re: [Qemu-devel] [PULL 0/9] usb: various bugfixes, mostly xhci., no-reply, 2017/02/06
- Re: [Qemu-devel] [PULL 0/9] usb: various bugfixes, mostly xhci., Peter Maydell, 2017/02/06