hw-usb-core-fix-buffer-overflow From 18ad0451f113ffc3a2ff59c059d189cca1e42842 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 19 Aug 2020 17:04:04 +0800 Subject: [PATCH] hw/usb/core.c fix buffer overflow Store calculated setup_len in a local variable, verify it, and only write it to the struct (USBDevice->setup_len) in case it passed the sanity checks. This prevents other code (do_token_{in,out} function specifically) from working with invalid USBDevice->setup_len values and overruning the USBDevice->setup_buf[] buffer. Store Fixes: CVE-2020-14364 Signed-off-by: Gred Hoffman --- hw/usb/core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/usb/core.c b/hw/usb/core.c index 5abd128b..12342f13 100644 --- a/hw/usb/core.c +++ b/hw/usb/core.c @@ -144,6 +144,8 @@ static void do_token_setup(USBDevice *s, USBPacket *p) "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n", s->setup_len, sizeof(s->data_buf)); p->status = USB_RET_STALL; + s->setup_len = 0; + s->setup_state = SETUP_STATE_ACK; return; } @@ -277,6 +279,8 @@ static void do_parameter(USBDevice *s, USBPacket *p) "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n", s->setup_len, sizeof(s->data_buf)); p->status = USB_RET_STALL; + s->setup_len = 0; + s->setup_state = SETUP_STATE_ACK; return; } -- 2.23.0