]> git.ipfire.org Git - thirdparty/qemu.git/commit
hw/usb/hcd-dwc2: fix divide-by-zero in dwc2_handle_packet()
authorMauro Matteo Cascella <mcascell@redhat.com>
Thu, 15 Oct 2020 07:59:57 +0000 (09:59 +0200)
committerGerd Hoffmann <kraxel@redhat.com>
Mon, 19 Oct 2020 07:17:21 +0000 (09:17 +0200)
commitbea2a9e3e00b275dc40cfa09c760c715b8753e03
tree8dc1d99ffbc615c58121e422866cbdccc2a8ac41
parentccee80c68db14b3e965582a19393992b5c2b97f4
hw/usb/hcd-dwc2: fix divide-by-zero in dwc2_handle_packet()

Check the value of mps to avoid potential divide-by-zero later in the function.
Since HCCHAR_MPS is guest controllable, this prevents a malicious/buggy guest
from crashing the QEMU process on the host.

Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reviewed-by: Paul Zimmerman <pauldzim@gmail.com>
Reported-by: Gaoning Pan <gaoning.pgn@antgroup.com>
Reported-by: Xingwei Lin <linyi.lxw@antfin.com>
Message-id: 20201015075957.268823-1-mcascell@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
hw/usb/hcd-dwc2.c