diff mbox

[5/5] uas: Bounds check tags when using streams

Message ID 1382634953-9240-6-git-send-email-hdegoede@redhat.com
State New
Headers show

Commit Message

Hans de Goede Oct. 24, 2013, 5:15 p.m. UTC 
Disallow the guest to cause us to address the data3 and status3 arrays
out of bounds.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
---
 hw/usb/dev-uas.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
diff mbox

Patch

diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c
index 70f41d3..5884035 100644
--- a/hw/usb/dev-uas.c
+++ b/hw/usb/dev-uas.c
@@ -692,6 +692,9 @@  static void usb_uas_command(UASDevice *uas, uas_ui *ui)
     uint32_t len;
     uint16_t tag = be16_to_cpu(ui->hdr.tag);
 
+    if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) {
+        goto invalid_tag;
+    }
     req = usb_uas_find_request(uas, tag);
     if (req) {
         goto overlapped_tag;
@@ -724,6 +727,10 @@  static void usb_uas_command(UASDevice *uas, uas_ui *ui)
     }
     return;
 
+invalid_tag:
+    usb_uas_queue_fake_sense(uas, tag, sense_code_INVALID_TAG);
+    return;
+
 overlapped_tag:
     usb_uas_queue_fake_sense(uas, tag, sense_code_OVERLAPPED_COMMANDS);
     return;
@@ -742,6 +749,9 @@  static void usb_uas_task(UASDevice *uas, uas_ui *ui)
     UASRequest *req;
     uint16_t task_tag;
 
+    if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) {
+        goto invalid_tag;
+    }
     req = usb_uas_find_request(uas, be16_to_cpu(ui->hdr.tag));
     if (req) {
         goto overlapped_tag;
@@ -774,6 +784,10 @@  static void usb_uas_task(UASDevice *uas, uas_ui *ui)
     }
     return;
 
+invalid_tag:
+    usb_uas_queue_response(uas, tag, UAS_RC_INVALID_INFO_UNIT, 0);
+    return;
+
 overlapped_tag:
     usb_uas_queue_response(uas, req->tag, UAS_RC_OVERLAPPED_TAG, 0);
     return;