summaryrefslogtreecommitdiffstats
path: root/hw/usb
diff options
context:
space:
mode:
authorGerd Hoffmann2017-07-03 13:15:49 +0200
committerGerd Hoffmann2017-07-17 11:39:08 +0200
commit2a7f2630684ee556a394a354d64159a4470c0151 (patch)
tree9406e3e91d13003420395c97f93b08233999f3a5 /hw/usb
parentMerge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20170711'... (diff)
downloadqemu-2a7f2630684ee556a394a354d64159a4470c0151.tar.gz
qemu-2a7f2630684ee556a394a354d64159a4470c0151.tar.xz
qemu-2a7f2630684ee556a394a354d64159a4470c0151.zip
ehci: add sanity check for maxframes
Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20170703111549.10924-1-kraxel@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/usb')
-rw-r--r--hw/usb/hcd-ehci.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 73090e01ad..604912cb3e 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -2483,6 +2483,11 @@ void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
NB_PORTS);
return;
}
+ if (s->maxframes < 8 || s->maxframes > 512) {
+ error_setg(errp, "maxframes %d out if range (8 .. 512)",
+ s->maxframes);
+ return;
+ }
usb_bus_new(&s->bus, sizeof(s->bus), s->companion_enable ?
&ehci_bus_ops_companion : &ehci_bus_ops_standalone, dev);