ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

usb/hcd-xhci: check slotid in xhci_wakeup_endpoint() 

This prevents an OOB read (followed by an assertion failure in
xhci_kick_ep) when slotid > xhci->numslots.

Reported-by: Soul Chen <soulchen8650@gmail.com>
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Message-Id: <20220705174734.2348829-1-mcascell@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Mauro Matteo Cascella 2022-07-05 19:47:34 +02:00 committed by Gerd Hoffmann
parent 3ef1497b46
commit 84218892f0
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
hw/usb/hcd-xhci.c
View File

@ -3269,7 +3269,8 @@ static void xhci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep,
DPRINTF("%s\n", __func__);
slotid = ep->dev->addr;
if (slotid == 0 || !xhci->slots[slotid-1].enabled) {
if (slotid == 0 || slotid > xhci->numslots ||
!xhci->slots[slotid - 1].enabled) {
DPRINTF("%s: oops, no slot for dev %d\n", __func__, ep->dev->addr);
return;
}