diff options
| author | Gerd Hoffmann | 2017-02-16 14:13:39 +0100 |
|---|---|---|
| committer | Gerd Hoffmann | 2017-02-21 08:11:43 +0100 |
| commit | 31fb4444a485a348f8e2699d7c3dd15e1819ad2c (patch) | |
| tree | 1a9f1ecb1c10c4eafd90fadb93c32020f253aef7 /hw/usb/hcd-ehci.c | |
| parent | usb-ccid: move header size check (diff) | |
| download | qemu-31fb4444a485a348f8e2699d7c3dd15e1819ad2c.tar.gz qemu-31fb4444a485a348f8e2699d7c3dd15e1819ad2c.tar.xz qemu-31fb4444a485a348f8e2699d7c3dd15e1819ad2c.zip | |
usb-ccid: add check message size checks
Check message size too when figuring whenever we should expect more data.
Fix debug message to show useful data, p->iov.size is fixed anyway if we
land there, print how much we got meanwhile instead.
Also check announced message size against actual message size. That
is a more general fix for CVE-2017-5898 than commit "c7dfbf3 usb: ccid:
check ccid apdu length".
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 1487250819-23764-4-git-send-email-kraxel@redhat.com
Diffstat (limited to 'hw/usb/hcd-ehci.c')
0 files changed, 0 insertions, 0 deletions