42 lines
1.2 KiB
Diff
42 lines
1.2 KiB
Diff
https://bugs.gentoo.org/510208
|
|
|
|
From 719ffe1f5f72b1c7ace4afe9ba2815bcb53a829e Mon Sep 17 00:00:00 2001
|
|
From: "Michael S. Tsirkin" <mst@redhat.com>
|
|
Date: Tue, 13 May 2014 12:33:16 +0300
|
|
Subject: [PATCH] usb: fix up post load checks
|
|
|
|
Correct post load checks:
|
|
1. dev->setup_len == sizeof(dev->data_buf)
|
|
seems fine, no need to fail migration
|
|
2. When state is DATA, passing index > len
|
|
will cause memcpy with negative length,
|
|
resulting in heap overflow
|
|
|
|
First of the issues was reported by dgilbert.
|
|
|
|
Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
|
|
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
|
Signed-off-by: Juan Quintela <quintela@redhat.com>
|
|
---
|
|
hw/usb/bus.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/hw/usb/bus.c b/hw/usb/bus.c
|
|
index 699aa10..927a47b 100644
|
|
--- a/hw/usb/bus.c
|
|
+++ b/hw/usb/bus.c
|
|
@@ -51,8 +51,8 @@ static int usb_device_post_load(void *opaque, int version_id)
|
|
}
|
|
if (dev->setup_index < 0 ||
|
|
dev->setup_len < 0 ||
|
|
- dev->setup_index >= sizeof(dev->data_buf) ||
|
|
- dev->setup_len >= sizeof(dev->data_buf)) {
|
|
+ dev->setup_index > dev->setup_len ||
|
|
+ dev->setup_len > sizeof(dev->data_buf)) {
|
|
return -EINVAL;
|
|
}
|
|
return 0;
|
|
--
|
|
1.9.3
|
|
|