b946434f26
Store calculated setup_len in a local variable, verify it, and only
write it to the struct (USBDevice->setup_len) in case it passed the
sanity checks.
This prevents other code (do_token_{in,out} functions specifically)
from working with invalid USBDevice->setup_len values and overrunning
the USBDevice->setup_buf[] buffer.
Fixes: CVE-2020-14364
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Tested-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Message-id: 20200825053636.29648-1-kraxel@redhat.com
|
||
|---|---|---|
| .. | ||
| 9pfs | ||
| acpi | ||
| adc | ||
| alpha | ||
| arm | ||
| audio | ||
| avr | ||
| block | ||
| char | ||
| core | ||
| cpu | ||
| cris | ||
| display | ||
| dma | ||
| gpio | ||
| hppa | ||
| hyperv | ||
| i2c | ||
| i386 | ||
| ide | ||
| input | ||
| intc | ||
| ipack | ||
| ipmi | ||
| isa | ||
| lm32 | ||
| m68k | ||
| mem | ||
| microblaze | ||
| mips | ||
| misc | ||
| moxie | ||
| net | ||
| nios2 | ||
| nubus | ||
| nvram | ||
| openrisc | ||
| pci | ||
| pci-bridge | ||
| pci-host | ||
| pcmcia | ||
| ppc | ||
| rdma | ||
| riscv | ||
| rtc | ||
| rx | ||
| s390x | ||
| scsi | ||
| sd | ||
| semihosting | ||
| sh4 | ||
| smbios | ||
| sparc | ||
| sparc64 | ||
| ssi | ||
| timer | ||
| tpm | ||
| tricore | ||
| unicore32 | ||
| usb | ||
| vfio | ||
| virtio | ||
| watchdog | ||
| xen | ||
| xenpv | ||
| xtensa | ||
| Kconfig | ||
| meson.build | ||