From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:55347) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VmJ6C-0002U8-Es for qemu-devel@nongnu.org; Fri, 29 Nov 2013 03:06:54 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VmJ61-0002CB-7x for qemu-devel@nongnu.org; Fri, 29 Nov 2013 03:06:51 -0500 Received: from mx1.redhat.com ([209.132.183.28]:29266) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VmJ60-0002Be-Rb for qemu-devel@nongnu.org; Fri, 29 Nov 2013 03:06:41 -0500 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id rAT86eBp018763 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Fri, 29 Nov 2013 03:06:40 -0500 From: Gerd Hoffmann Date: Fri, 29 Nov 2013 09:06:11 +0100 Message-Id: <1385712381-30918-8-git-send-email-kraxel@redhat.com> In-Reply-To: <1385712381-30918-1-git-send-email-kraxel@redhat.com> References: <1385712381-30918-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PATCH 07/17] uas: Bounds check tags when using streams List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Hans de Goede , Gerd Hoffmann From: Hans de Goede Disallow the guest to cause us to address the data3 and status3 arrays out of bounds. Signed-off-by: Hans de Goede Signed-off-by: Gerd Hoffmann --- hw/usb/dev-uas.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c index 70f41d3..5884035 100644 --- a/hw/usb/dev-uas.c +++ b/hw/usb/dev-uas.c @@ -692,6 +692,9 @@ static void usb_uas_command(UASDevice *uas, uas_ui *ui) uint32_t len; uint16_t tag = be16_to_cpu(ui->hdr.tag); + if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) { + goto invalid_tag; + } req = usb_uas_find_request(uas, tag); if (req) { goto overlapped_tag; @@ -724,6 +727,10 @@ static void usb_uas_command(UASDevice *uas, uas_ui *ui) } return; +invalid_tag: + usb_uas_queue_fake_sense(uas, tag, sense_code_INVALID_TAG); + return; + overlapped_tag: usb_uas_queue_fake_sense(uas, tag, sense_code_OVERLAPPED_COMMANDS); return; @@ -742,6 +749,9 @@ static void usb_uas_task(UASDevice *uas, uas_ui *ui) UASRequest *req; uint16_t task_tag; + if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) { + goto invalid_tag; + } req = usb_uas_find_request(uas, be16_to_cpu(ui->hdr.tag)); if (req) { goto overlapped_tag; @@ -774,6 +784,10 @@ static void usb_uas_task(UASDevice *uas, uas_ui *ui) } return; +invalid_tag: + usb_uas_queue_response(uas, tag, UAS_RC_INVALID_INFO_UNIT, 0); + return; + overlapped_tag: usb_uas_queue_response(uas, req->tag, UAS_RC_OVERLAPPED_TAG, 0); return; -- 1.8.3.1