diff options
| author | Anthony Liguori <anthony@codemonkey.ws> | 2013-09-11 14:46:21 -0500 |
|---|---|---|
| committer | Anthony Liguori <anthony@codemonkey.ws> | 2013-09-11 14:46:21 -0500 |
| commit | a640f07c0d03bfa3031af1fc0a32b0d779917d17 (patch) | |
| tree | aef05faa1cb19136263cd28fcd061ff71ae68144 /hw/usb/bus.c | |
| parent | f69f0bcac951f3c3089246695874b84ea8967936 (diff) | |
| parent | adbecc89731cf3e0ae656d50ea9fa58c589c4bdc (diff) | |
| download | qemu-a640f07c0d03bfa3031af1fc0a32b0d779917d17.tar.gz | |
Merge remote-tracking branch 'kraxel/usb.89' into staging
# By Gerd Hoffmann (2) and Miroslav Rezanina (2)
# Via Gerd Hoffmann
* kraxel/usb.89:
ehci: save device pointer in EHCIState
Remove dev-bluetooth.c dependency from vl.c
Preparation for usb-bt-dongle conditional build
usb: sanity check setup_index+setup_len in post_load
Message-id: 1378806073-25197-1-git-send-email-kraxel@redhat.com
Signed-off-by: Anthony Liguori <anthony@codemonkey.ws>
Diffstat (limited to 'hw/usb/bus.c')
| -rw-r--r-- | hw/usb/bus.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/usb/bus.c b/hw/usb/bus.c index 82ca6a13e8..72d5b92225 100644 --- a/hw/usb/bus.c +++ b/hw/usb/bus.c @@ -47,6 +47,10 @@ static int usb_device_post_load(void *opaque, int version_id) } else { dev->attached = 1; } + if (dev->setup_index >= sizeof(dev->data_buf) || + dev->setup_len >= sizeof(dev->data_buf)) { + return -EINVAL; + } return 0; } |