On 16/07/2026 21.33, Thomas Huth wrote:
From: Thomas Huth <[email protected]>
The stream ID is under control of the guest, so we must not use
it for indexing into the status3[] array without checking it for
being in range.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3612
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3986
As requested by the reporter in the bug ticket:
Reported-by: Tristan Madani <[email protected]>
Signed-off-by: Thomas Huth <[email protected]>
---
hw/usb/dev-uas.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c
index 8576dfec96f..7df58cdeee7 100644
--- a/hw/usb/dev-uas.c
+++ b/hw/usb/dev-uas.c
@@ -383,8 +383,15 @@ static void usb_uas_send_status_bh(void *opaque)
static void usb_uas_queue_status(UASDevice *uas, UASStatus *st, int length)
{
- USBPacket *p = uas_using_streams(uas) ?
- uas->status3[st->stream] : uas->status2;
+ USBPacket *p = NULL;
+
+ if (!uas_using_streams(uas)) {
+ p = uas->status2;
+ } else if (st->stream <= UAS_MAX_STREAMS) {
+ p = uas->status3[st->stream];
+ } else {
+ warn_report_once(TYPE_USB_UAS ": bad stream ID 0x%x", st->stream);
+ }
st->length += length;
QTAILQ_INSERT_TAIL(&uas->results, st, next);
