adb_request() accesses buf[0] unconditionally for tracing before processing the request. A zero-length buffer causes an out-of-bounds read. Return early with -1, which all callers already handle (they check for > 0 before using the result).
Reported-by: Pavee Hui <[email protected]> Fixes: e590e7f01479 ("adb: add ADB bus trace events") Signed-off-by: Marc-André Lureau <[email protected]> --- hw/input/adb.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/input/adb.c b/hw/input/adb.c index 29c09c755966..7c67d2baa663 100644 --- a/hw/input/adb.c +++ b/hw/input/adb.c @@ -96,6 +96,10 @@ int adb_request(ADBBusState *s, uint8_t *obuf, const uint8_t *buf, int len) { int ret; + if (len < 1) { + return -1; + } + trace_adb_bus_request(buf[0] >> 4, adb_commands[buf[0] & 0xf], len); assert(s->autopoll_blocked); -- 2.56.0.rc0.29.g47ce80527c56
