From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:34079) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QHeDB-0008Gz-SP for qemu-devel@nongnu.org; Wed, 04 May 2011 11:42:02 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QHeDA-0007KQ-U5 for qemu-devel@nongnu.org; Wed, 04 May 2011 11:42:01 -0400 Received: from mx1.redhat.com ([209.132.183.28]:30449) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QHeDA-0007KH-LZ for qemu-devel@nongnu.org; Wed, 04 May 2011 11:42:00 -0400 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p44Ffx0k024475 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 4 May 2011 11:41:59 -0400 From: Gerd Hoffmann Date: Wed, 4 May 2011 17:41:42 +0200 Message-Id: <1304523708-9556-9-git-send-email-kraxel@redhat.com> In-Reply-To: <1304523708-9556-1-git-send-email-kraxel@redhat.com> References: <1304523708-9556-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PATCH 08/14] usb: control buffer fixes List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Hans de Goede , Gerd Hoffmann From: Hans de Goede Windows allows control transfers to pass up to 4k of data, so raise our control buffer size to 4k. For control out transfers the usb core code copies the control request data to a buffer before calling the device's handle_control callback. Add a check for overflowing the buffer before copying the data. Signed-off-by: Hans de Goede Signed-off-by: Gerd Hoffmann --- hw/usb.c | 6 ++++++ hw/usb.h | 2 +- 2 files changed, 7 insertions(+), 1 deletions(-) diff --git a/hw/usb.c b/hw/usb.c index 82a6217..d8c0a75 100644 --- a/hw/usb.c +++ b/hw/usb.c @@ -93,6 +93,12 @@ static int do_token_setup(USBDevice *s, USBPacket *p) s->setup_len = ret; s->setup_state = SETUP_STATE_DATA; } else { + if (s->setup_len > sizeof(s->data_buf)) { + fprintf(stderr, + "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n", + s->setup_len, sizeof(s->data_buf)); + return USB_RET_STALL; + } if (s->setup_len == 0) s->setup_state = SETUP_STATE_ACK; else diff --git a/hw/usb.h b/hw/usb.h index d3d755d..22bb338 100644 --- a/hw/usb.h +++ b/hw/usb.h @@ -167,7 +167,7 @@ struct USBDevice { int32_t state; uint8_t setup_buf[8]; - uint8_t data_buf[1024]; + uint8_t data_buf[4096]; int32_t remote_wakeup; int32_t setup_state; int32_t setup_len; -- 1.7.1