diff options
| author | Michael S. Tsirkin <mst@redhat.com> | 2014-05-13 12:33:16 +0300 |
|---|---|---|
| committer | Juan Quintela <quintela@trasno.org> | 2014-05-14 15:24:52 +0200 |
| commit | 719ffe1f5f72b1c7ace4afe9ba2815bcb53a829e (patch) | |
| tree | f3a928ff50a684a2d630338c454b4627d5e13b36 | |
| parent | d6ed7312d11995409bd53ef8f1a743d8877880d2 (diff) | |
| download | qemu-719ffe1f5f72b1c7ace4afe9ba2815bcb53a829e.zip qemu-719ffe1f5f72b1c7ace4afe9ba2815bcb53a829e.tar.gz qemu-719ffe1f5f72b1c7ace4afe9ba2815bcb53a829e.tar.bz2 | |
usb: fix up post load checks
Correct post load checks:
1. dev->setup_len == sizeof(dev->data_buf)
seems fine, no need to fail migration
2. When state is DATA, passing index > len
will cause memcpy with negative length,
resulting in heap overflow
First of the issues was reported by dgilbert.
Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
| -rw-r--r-- | hw/usb/bus.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/usb/bus.c b/hw/usb/bus.c index 699aa10..927a47b 100644 --- a/hw/usb/bus.c +++ b/hw/usb/bus.c @@ -51,8 +51,8 @@ static int usb_device_post_load(void *opaque, int version_id) } if (dev->setup_index < 0 || dev->setup_len < 0 || - dev->setup_index >= sizeof(dev->data_buf) || - dev->setup_len >= sizeof(dev->data_buf)) { + dev->setup_index > dev->setup_len || + dev->setup_len > sizeof(dev->data_buf)) { return -EINVAL; } return 0; |