diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2021-09-01 15:13:07 +0100 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2021-09-01 15:13:07 +0100 |
| commit | 4c41a1c595e1ce3fe29f3b7bb22ff7402be9c77d (patch) | |
| tree | 12a0c4b757d9c84d4fa59824333f8c0066ed9ca4 /hw/usb/dev-uas.c | |
| parent | 9ca9f47fdaf5deaf6f073e0b81de575a6cb73445 (diff) | |
| parent | ae420c957aff2871b8a1af9cf9ee1a7a75b3552b (diff) | |
Merge remote-tracking branch 'remotes/kraxel/tags/usb-20210901-pull-request' into staging
usb: bugfixes.
# gpg: Signature made Wed 01 Sep 2021 07:53:33 BST
# gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138
* remotes/kraxel/tags/usb-20210901-pull-request:
hw/usb: Fix typo in comments and print
uas: add stream number sanity checks.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'hw/usb/dev-uas.c')
| -rw-r--r-- | hw/usb/dev-uas.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c index 263056231c..f6309a5ebf 100644 --- a/hw/usb/dev-uas.c +++ b/hw/usb/dev-uas.c @@ -840,6 +840,9 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) } break; case UAS_PIPE_ID_STATUS: + if (p->stream > UAS_MAX_STREAMS) { + goto err_stream; + } if (p->stream) { QTAILQ_FOREACH(st, &uas->results, next) { if (st->stream == p->stream) { @@ -867,6 +870,9 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) break; case UAS_PIPE_ID_DATA_IN: case UAS_PIPE_ID_DATA_OUT: + if (p->stream > UAS_MAX_STREAMS) { + goto err_stream; + } if (p->stream) { req = usb_uas_find_request(uas, p->stream); } else { @@ -902,6 +908,11 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) p->status = USB_RET_STALL; break; } + +err_stream: + error_report("%s: invalid stream %d", __func__, p->stream); + p->status = USB_RET_STALL; + return; } static void usb_uas_unrealize(USBDevice *dev) |