diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2014-11-17 17:22:03 +0000 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2014-11-17 17:22:03 +0000 |
| commit | 1aba4be97eb01b650d146c7f01dc961d55da62ab (patch) | |
| tree | 76a1ef0b1c33fdc3014036fa9de5c4c4300773d6 /hw/usb/hcd-musb.c | |
| parent | d8edf52a51846286ecdbe8370b5111655618e849 (diff) | |
| parent | a9be76576e375a994bbcea0a5eb2a3852969de0e (diff) | |
| download | hqemu-1aba4be97eb01b650d146c7f01dc961d55da62ab.zip hqemu-1aba4be97eb01b650d146c7f01dc961d55da62ab.tar.gz | |
Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging
A smattering of fixes for problems that Coverity reported.
# gpg: Signature made Mon 17 Nov 2014 17:03:25 GMT using RSA key ID 78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg: aka "Paolo Bonzini <pbonzini@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg: It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1
# Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83
* remotes/bonzini/tags/for-upstream:
hcd-musb: fix dereference null return value
target-cris/translate.c: fix out of bounds read
shpc: fix error propaagation
qemu-char: fix MISSING_COMMA
acl: fix memory leak
nvme: remove superfluous check
loader: fix NEGATIVE_RETURNS
qga: fix false negative argument passing
mips_mipssim: fix use-after-free for filename
l2tpv3: fix fd leak
l2tpv3: fix possible double free
libcacard: fix resource leak
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'hw/usb/hcd-musb.c')
| -rw-r--r-- | hw/usb/hcd-musb.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/hw/usb/hcd-musb.c b/hw/usb/hcd-musb.c index 66bc61a..40809f6 100644 --- a/hw/usb/hcd-musb.c +++ b/hw/usb/hcd-musb.c @@ -608,6 +608,7 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep, USBDevice *dev; USBEndpoint *uep; int idx = epnum && dir; + int id; int ttype; /* ep->type[0,1] contains: @@ -625,8 +626,11 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep, /* A wild guess on the FADDR semantics... */ dev = usb_find_device(&s->port, ep->faddr[idx]); uep = usb_ep_get(dev, pid, ep->type[idx] & 0xf); - usb_packet_setup(&ep->packey[dir].p, pid, uep, 0, - (dev->addr << 16) | (uep->nr << 8) | pid, false, true); + id = pid; + if (uep) { + id |= (dev->addr << 16) | (uep->nr << 8); + } + usb_packet_setup(&ep->packey[dir].p, pid, uep, 0, id, false, true); usb_packet_addbuf(&ep->packey[dir].p, ep->buf[idx], len); ep->packey[dir].ep = ep; ep->packey[dir].dir = dir; |
