On Mon, 20 Jul 2026 at 14:50, Thomas Huth <[email protected]> wrote: > > From: Thomas Huth <[email protected]> > > The stream ID is under control of the guest, and some spots in the > code currently use it for indexing into the status3[] array without > checking it for being in range first, so the code accesses the heap > beyond the limit of the status3 array. > > Since our status delivery code depends on having a valid stream ID, > we must not try to generate a fake sense code in this situation. > Simply log a guest error and return early in usb_uas_command(). > > And to make sure that we really cannot access the status3[] array > beyond its limit anymore, add some assert() statements in the > affected functions, too. > > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3612 > Reported-by: Reported-by: huntr bubble > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3986 > Reported-by: Tristan Madani <[email protected]> > Suggested-by: Peter Maydell <[email protected]> > Signed-off-by: Thomas Huth <[email protected]> > --- > v2: Refuse illegal tags already in usb_uas_command()
Reviewed-by: Peter Maydell <[email protected]> thanks -- PMM
