[PATCH 55/63] hw/input/adb-mouse: validate WRITEREG request buffer length

[Marc-André Lureau]

The ADB_WRITEREG handler accesses buf[1] without checking that
enough data was provided, allowing an out-of-bounds read from a
short request buffer.

Add a length check requiring at least 2 bytes before reading
buf[1].

Fixes: 267002cd2831 ("CUDA + ADB support")
Reported-by: Pavee Hui <p...@google.com>
Signed-off-by: Marc-André Lureau <marcandre.lur...@redhat.com>
---
 hw/input/adb-mouse.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/input/adb-mouse.c b/hw/input/adb-mouse.c
index 5dcdc851fcdf..80584cce1c6b 100644
--- a/hw/input/adb-mouse.c
+++ b/hw/input/adb-mouse.c
@@ -164,6 +164,9 @@ static int adb_mouse_request(ADBDevice *d, uint8_t *obuf,
     olen = 0;
     switch (cmd) {
     case ADB_WRITEREG:
+        if (len < 2) {
+            return 0;
+        }
         trace_adb_device_mouse_writereg(reg, buf[1]);
         switch (reg) {
         case 2:

-- 
2.56.0.rc0.29.g47ce80527c56