motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-30 13:31:52 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

uas: Bounds check tags when using streams

Browse source 
Disallow the guest to cause us to address the data3 and status3 arrays
out of bounds.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Hans de Goede 2013-10-24 18:15:53 +01:00 • committed by Gerd Hoffmann
parent 0478661ec5
commit 3453f9a0df
1 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
hw/usb/dev-uas.c
View file

@ -692,6 +692,9 @@ static void usb_uas_command(UASDevice *uas, uas_ui *ui)
uint32_t len; uint32_t len;
uint16_t tag = be16_to_cpu(ui->hdr.tag); uint16_t tag = be16_to_cpu(ui->hdr.tag);
if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) {
goto invalid_tag;
}
req = usb_uas_find_request(uas, tag); req = usb_uas_find_request(uas, tag);
if (req) { if (req) {
goto overlapped_tag; goto overlapped_tag;
@ -724,6 +727,10 @@ static void usb_uas_command(UASDevice *uas, uas_ui *ui)
} }
return; return;
invalid_tag:
usb_uas_queue_fake_sense(uas, tag, sense_code_INVALID_TAG);
return;
overlapped_tag: overlapped_tag:
usb_uas_queue_fake_sense(uas, tag, sense_code_OVERLAPPED_COMMANDS); usb_uas_queue_fake_sense(uas, tag, sense_code_OVERLAPPED_COMMANDS);
return; return;
@ -742,6 +749,9 @@ static void usb_uas_task(UASDevice *uas, uas_ui *ui)
UASRequest *req; UASRequest *req;
uint16_t task_tag; uint16_t task_tag;
if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) {
goto invalid_tag;
}
req = usb_uas_find_request(uas, be16_to_cpu(ui->hdr.tag)); req = usb_uas_find_request(uas, be16_to_cpu(ui->hdr.tag));
if (req) { if (req) {
goto overlapped_tag; goto overlapped_tag;
@ -774,6 +784,10 @@ static void usb_uas_task(UASDevice *uas, uas_ui *ui)
} }
return; return;
invalid_tag:
usb_uas_queue_response(uas, tag, UAS_RC_INVALID_INFO_UNIT, 0);
return;
overlapped_tag: overlapped_tag:
usb_uas_queue_response(uas, req->tag, UAS_RC_OVERLAPPED_TAG, 0); usb_uas_queue_response(uas, req->tag, UAS_RC_OVERLAPPED_TAG, 0);
return; return;