]> xenbits.xensource.com Git - qemu-upstream-4.5-testing.git/commit
usb: fix up post load checks
authorMichael S. Tsirkin <mst@redhat.com>
Tue, 13 May 2014 09:33:16 +0000 (12:33 +0300)
committerStefano Stabellini <stefano.stabellini@eu.citrix.com>
Wed, 4 Mar 2015 17:18:49 +0000 (17:18 +0000)
commitbedbc31c141f712716ddc8933bd0a52abd0b1c8a
tree09b2f0c07bc1d0daf96211d2d0b15acba6ecff3e
parentc2757fed63ffa97bbf72c11983f22176227e9df0
usb: fix up post load checks

Correct post load checks:
1. dev->setup_len == sizeof(dev->data_buf)
    seems fine, no need to fail migration
2. When state is DATA, passing index > len
   will cause memcpy with negative length,
   resulting in heap overflow

First of the issues was reported by dgilbert.

Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
hw/usb/bus.c