haraldwolff/qemu-patch-raspberry4
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

usb-mtp: Return error on suspicious TYPE_DATA packet from initiator

Browse source 
CID 1390604
If the initiator sends a packet with TYPE_DATA set without
initiating a CMD_GET_OBJECT_INFO first, then usb_mtp_get_data
can trip on a null s->data_out.

Signed-off-by: Bandan Das <bsd@redhat.com>
Message-Id: <jpgr2m8ajfk.fsf_-_@linux.bootlegged.copy>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Bandan Das 2018-05-18 14:49:03 -04:00 committed by Gerd Hoffmann
parent 1a3ff20e67
commit 3c969a6022
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
hw/usb/dev-mtp.c
View file

@ -1700,6 +1700,11 @@ static void usb_mtp_get_data(MTPState *s, mtp_container *container,
uint64_t dlen;
uint32_t data_len = p->iov.size;
if (!d) {
usb_mtp_queue_result(s, RES_INVALID_OBJECTINFO, 0,
0, 0, 0, 0);
return;
}
if (d->first) {
/* Total length of incoming data */
d->length = cpu_to_le32(container->length) - sizeof(mtp_container);