diff options
| author | Thomas Huth <thuth@redhat.com> | 2016-05-23 11:23:07 +0200 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2016-05-23 14:59:40 +0200 |
| commit | d400fc018b326104d26d730e5cc8c36c1f662c34 (patch) | |
| tree | ecf9f267afd868aa035e508522f10be06c96a1c9 /hw/usb/hcd-ohci.c | |
| parent | 816ac92ef769f9ffc534e49a1bb6177bddce7aa2 (diff) | |
| download | qemu-d400fc018b326104d26d730e5cc8c36c1f662c34.zip qemu-d400fc018b326104d26d730e5cc8c36c1f662c34.tar.gz qemu-d400fc018b326104d26d730e5cc8c36c1f662c34.tar.bz2 | |
usb/ohci: Fix crash with when specifying too many num-ports
QEMU currently crashes when an OHCI controller is instantiated with
too many ports, e.g. "-device pci-ohci,num-ports=100,masterbus=1".
Thus add a proper check in usb_ohci_init() to make sure that we
do not use more than OHCI_MAX_PORTS = 15 ports here.
Ticket: https://bugs.launchpad.net/qemu/+bug/1581308
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1463995387-11710-1-git-send-email-thuth@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/usb/hcd-ohci.c')
| -rw-r--r-- | hw/usb/hcd-ohci.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c index ffab561..16d9ff7 100644 --- a/hw/usb/hcd-ohci.c +++ b/hw/usb/hcd-ohci.c @@ -1848,6 +1848,12 @@ static void usb_ohci_init(OHCIState *ohci, DeviceState *dev, ohci->as = as; + if (num_ports > OHCI_MAX_PORTS) { + error_setg(errp, "OHCI num-ports=%d is too big (limit is %d ports)", + num_ports, OHCI_MAX_PORTS); + return; + } + if (usb_frame_time == 0) { #ifdef OHCI_TIME_WARP usb_frame_time = NANOSECONDS_PER_SECOND; |