From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52868) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aT63F-0005PD-J5 for qemu-devel@nongnu.org; Tue, 09 Feb 2016 06:01:46 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aT639-0002NS-NA for qemu-devel@nongnu.org; Tue, 09 Feb 2016 06:01:45 -0500 Received: from mx1.redhat.com ([209.132.183.28]:42480) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aT639-0002NO-In for qemu-devel@nongnu.org; Tue, 09 Feb 2016 06:01:39 -0500 Date: Tue, 9 Feb 2016 16:31:33 +0530 (IST) From: P J P In-Reply-To: <1454669651-29411-1-git-send-email-ppandit@redhat.com> Message-ID: References: <1454669651-29411-1-git-send-email-ppandit@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Subject: Re: [Qemu-devel] [PATCH] usb: check RNDIS buffer offsets & length List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Gerd Hoffmann Cc: Qinghao Tang , Qemu Developers +-- On Fri, 5 Feb 2016, P J P wrote --+ | From: Prasad J Pandit | | When processing remote NDIS control message packets, the USB Net | device emulator uses a fixed length(4096) data buffer. The incoming | informationBufferOffset & Length combination could cross that range. | Check control message buffer offsets and length to avoid it. | | Reported-by: Qinghao Tang ...ping! -- - P J P 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F