[Qemu-devel] [PATCH 2/2] usb: deal with potential Null pointer returned by usb_ep_get()

[Liam Merwick <liam.merwick@oracle.com>]

From: Liam Merwick <Liam.Merwick@oracle.com>

usb_ep_get() can return a Null pointer in the (albeit unlikely) case
that a NULL USBDevice is passed in via the 'dev' parameter.  Before
dereferencing the return value from usb_ep_get(), check its validity
and use a default (invalid) value where needed.

Reported by the Parfait static code analysis tool

Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com>
Reviewed-by: Darren Kenny <Darren.Kenny@oracle.com>
Reviewed-by: Mark Kanda <Mark.Kanda@oracle.com>
Reviewed-by: Ameya More <ameya.more@oracle.com>
---
 hw/usb/core.c | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/hw/usb/core.c b/hw/usb/core.c
index 1aa0051b2b2d..9d46a4b41e99 100644
--- a/hw/usb/core.c
+++ b/hw/usb/core.c
@@ -733,19 +733,23 @@ struct USBEndpoint *usb_ep_get(USBDevice *dev, int pid, int ep)
 uint8_t usb_ep_get_type(USBDevice *dev, int pid, int ep)
 {
     struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
-    return uep->type;
+    return uep ? uep->type : USB_ENDPOINT_XFER_INVALID;
 }
 
 void usb_ep_set_type(USBDevice *dev, int pid, int ep, uint8_t type)
 {
     struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
-    uep->type = type;
+    if (uep) {
+        uep->type = type;
+    }
 }
 
 void usb_ep_set_ifnum(USBDevice *dev, int pid, int ep, uint8_t ifnum)
 {
     struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
-    uep->ifnum = ifnum;
+    if (uep) {
+        uep->ifnum = ifnum;
+    }
 }
 
 void usb_ep_set_max_packet_size(USBDevice *dev, int pid, int ep,
@@ -754,6 +758,10 @@ void usb_ep_set_max_packet_size(USBDevice *dev, int pid, int ep,
     struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
     int size, microframes;
 
+    if (!uep) {
+        return;
+    }
+
     size = raw & 0x7ff;
     switch ((raw >> 11) & 3) {
     case 1:
@@ -774,6 +782,10 @@ void usb_ep_set_max_streams(USBDevice *dev, int pid, int ep, uint8_t raw)
     struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
     int MaxStreams;
 
+    if (!uep) {
+        return;
+    }
+
     MaxStreams = raw & 0x1f;
     if (MaxStreams) {
         uep->max_streams = 1 << MaxStreams;
@@ -785,7 +797,9 @@ void usb_ep_set_max_streams(USBDevice *dev, int pid, int ep, uint8_t raw)
 void usb_ep_set_halted(USBDevice *dev, int pid, int ep, bool halted)
 {
     struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
-    uep->halted = halted;
+    if (uep) {
+        uep->halted = halted;
+    }
 }
 
 USBPacket *usb_ep_find_packet_by_id(USBDevice *dev, int pid, int ep,
@@ -794,6 +808,10 @@ USBPacket *usb_ep_find_packet_by_id(USBDevice *dev, int pid, int ep,
     struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
     USBPacket *p;
 
+    if (!uep) {
+        return NULL;
+    }
+
     QTAILQ_FOREACH(p, &uep->queue, queue) {
         if (p->id == id) {
             return p;
-- 
1.8.3.1