canokey_handle_data() takes the endpoint number from the USB packet (p->ep->nr, guest-selectable 1..15) and uses it to index the fixed-size ep_out[] / ep_out_size[] arrays of CanoKeyState, which hold only CANOKEY_EP_NUM = 3 entries. A forged bulk-OUT transfer on any endpoint number >= 3 therefore reads a bogus length from past ep_out_size[] and writes guest data through a wild pointer read from past ep_out[].
Validate p->ep->nr against CANOKEY_EP_NUM and return USB_RET_STALL for invalid endpoints, before any array access. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4481 Signed-off-by: Bin Guo <[email protected]> --- hw/usb/canokey.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/usb/canokey.c b/hw/usb/canokey.c index c3baedac2c..91dd886761 100644 --- a/hw/usb/canokey.c +++ b/hw/usb/canokey.c @@ -189,6 +189,11 @@ static void canokey_handle_data(USBDevice *dev, USBPacket *p) { CanoKeyState *key = CANOKEY(dev); + if (p->ep->nr >= CANOKEY_EP_NUM) { + p->status = USB_RET_STALL; + return; + } + uint8_t ep_in = CANOKEY_EP_IN(p->ep->nr); uint8_t ep_out = p->ep->nr; uint32_t in_len; -- 2.50.1 (Apple Git-155)
