Commit c60174e8 authored by Gerd Hoffmann's avatar Gerd Hoffmann
Browse files

usb: sanity check setup_index+setup_len in post_load 



Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent 94c2b6af

hw/usb/bus.c

+4 −0
Original line number Diff line number Diff line
@@ -47,6 +47,10 @@ static int usb_device_post_load(void *opaque, int version_id) 
    } else {

        dev->attached = 1;

    }

    if (dev->setup_index >= sizeof(dev->data_buf) ||

        dev->setup_len >= sizeof(dev->data_buf)) {

        return -EINVAL;

    }

    return 0;

}