From: Thomas Huth <[email protected]> The stream ID is under control of the guest, so we must not use it for indexing into the status3[] array without checking it for being in range.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3612 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3986 Signed-off-by: Thomas Huth <[email protected]> --- hw/usb/dev-uas.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c index 8576dfec96f..7df58cdeee7 100644 --- a/hw/usb/dev-uas.c +++ b/hw/usb/dev-uas.c @@ -383,8 +383,15 @@ static void usb_uas_send_status_bh(void *opaque) static void usb_uas_queue_status(UASDevice *uas, UASStatus *st, int length) { - USBPacket *p = uas_using_streams(uas) ? - uas->status3[st->stream] : uas->status2; + USBPacket *p = NULL; + + if (!uas_using_streams(uas)) { + p = uas->status2; + } else if (st->stream <= UAS_MAX_STREAMS) { + p = uas->status3[st->stream]; + } else { + warn_report_once(TYPE_USB_UAS ": bad stream ID 0x%x", st->stream); + } st->length += length; QTAILQ_INSERT_TAIL(&uas->results, st, next); -- 2.55.0
