Commit d400fc01 authored by Thomas Huth's avatar Thomas Huth Committed by Gerd Hoffmann
Browse files

usb/ohci: Fix crash with when specifying too many num-ports 

QEMU currently crashes when an OHCI controller is instantiated with
too many ports, e.g. "-device pci-ohci,num-ports=100,masterbus=1".
Thus add a proper check in usb_ohci_init() to make sure that we
do not use more than OHCI_MAX_PORTS = 15 ports here.

Ticket: https://bugs.launchpad.net/qemu/+bug/1581308


Signed-off-by: default avatarThomas Huth <thuth@redhat.com>
Message-id: 1463995387-11710-1-git-send-email-thuth@redhat.com
Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent 816ac92e

hw/usb/hcd-ohci.c

+6 −0
Original line number Diff line number Diff line
@@ -1848,6 +1848,12 @@ static void usb_ohci_init(OHCIState *ohci, DeviceState *dev, 


    ohci->as = as;



    if (num_ports > OHCI_MAX_PORTS) {

        error_setg(errp, "OHCI num-ports=%d is too big (limit is %d ports)",

                   num_ports, OHCI_MAX_PORTS);

        return;

    }



    if (usb_frame_time == 0) {

#ifdef OHCI_TIME_WARP

        usb_frame_time = NANOSECONDS_PER_SECOND;