diff options
| author | Hans de Goede <hdegoede@redhat.com> | 2010-11-26 14:59:35 +0100 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2011-05-04 12:25:24 +0200 |
| commit | 975f29984da4e25f2647d014ec3f4cf688c60e4d (patch) | |
| tree | cd9dd791a7cc540493d9ea6034ffa6efe543ca1f | |
| parent | a0b5fece8afe7deca08cbca97e2a4015d7f0038e (diff) | |
| download | hqemu-975f29984da4e25f2647d014ec3f4cf688c60e4d.zip hqemu-975f29984da4e25f2647d014ec3f4cf688c60e4d.tar.gz | |
usb-linux: Refuse iso packets when max packet size is 0 (alt setting 0)
Refuse iso usb packets when then max packet size for the endpoint is 0,
this avoids an abort in usb_host_alloc_iso() caused by trying to qemu_malloc
a 0 bytes large buffer.
| -rw-r--r-- | usb-linux.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/usb-linux.c b/usb-linux.c index 6aef7a5..4c42fe1 100644 --- a/usb-linux.c +++ b/usb-linux.c @@ -549,7 +549,11 @@ static int urb_status_to_usb_ret(int status) static int usb_host_handle_iso_data(USBHostDevice *s, USBPacket *p) { AsyncURB *aurb; - int i, j, ret, len = 0; + int i, j, ret, max_packet_size, len = 0; + + max_packet_size = get_max_packet_size(s, p->devep); + if (max_packet_size == 0) + return USB_RET_NAK; aurb = get_iso_urb(s, p->devep); if (!aurb) { |
