diff options
| author | Bandan Das <bsd@redhat.com> | 2018-05-18 14:49:03 -0400 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2018-06-12 12:08:12 +0200 |
| commit | 3c969a6022438cf59de10d2dc3c58f4807788f98 (patch) | |
| tree | c8c87127f418f8db40fbc368687142b8b4702784 /hw/usb | |
| parent | 1a3ff20e67330a15d62b00c2916e3541872103c0 (diff) | |
usb-mtp: Return error on suspicious TYPE_DATA packet from initiator
CID 1390604
If the initiator sends a packet with TYPE_DATA set without
initiating a CMD_GET_OBJECT_INFO first, then usb_mtp_get_data
can trip on a null s->data_out.
Signed-off-by: Bandan Das <bsd@redhat.com>
Message-Id: <jpgr2m8ajfk.fsf_-_@linux.bootlegged.copy>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/usb')
| -rw-r--r-- | hw/usb/dev-mtp.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index b0ab6a7912..1ded7ac9a3 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -1700,6 +1700,11 @@ static void usb_mtp_get_data(MTPState *s, mtp_container *container, uint64_t dlen; uint32_t data_len = p->iov.size; + if (!d) { + usb_mtp_queue_result(s, RES_INVALID_OBJECTINFO, 0, + 0, 0, 0, 0); + return; + } if (d->first) { /* Total length of incoming data */ d->length = cpu_to_le32(container->length) - sizeof(mtp_container); |