Daniel P. Berrangé 375cb86d9f usb-mtp: fix bounds check for guest provided filename ... The ObjectInfo struct has a variable length array containing the UTF-16 encoded filename. The number of characters of trailing data is given by the 'length' field in the struct and this must be validated against the size of the data packet received from the guest. Since the data is UTF-16, we must convert the byte count we have to a character count before validating. This must take care to truncate if a malicious guest sent an odd number of bytes. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Bandan Das <bsd@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>		2019-04-16 20:43:39 +01:00
..
bus.c	hw/usb/bus.c: Handle "no speed matched" case in usb_mask_to_str()	2019-04-01 08:53:44 +02:00
ccid-card-emulated.c
ccid-card-passthru.c
ccid.h
chipidea.c
combined-packet.c
core.c
desc-msos.c
desc.c
desc.h
dev-audio.c
dev-bluetooth.c
dev-hid.c
dev-hub.c
dev-mtp.c	usb-mtp: fix bounds check for guest provided filename	2019-04-16 20:43:39 +01:00
dev-network.c
dev-serial.c
dev-smartcard-reader.c
dev-storage.c
dev-uas.c
dev-wacom.c
hcd-ehci-pci.c
hcd-ehci-sysbus.c
hcd-ehci.c
hcd-ehci.h
hcd-musb.c
hcd-ohci.c
hcd-uhci.c
hcd-xhci-nec.c
hcd-xhci.c
hcd-xhci.h
host-libusb.c
host-stub.c
host.h
Kconfig
libhw.c
Makefile.objs
quirks-ftdi-ids.h
quirks-pl2303-ids.h
quirks.c
quirks.h
redirect.c
trace-events
tusb6010.c
xen-usb.c