The libusb host backend reads interface numbers from the active configuration descriptor while opening a device. An out-of-range number can index past USBDevice.altsetting. The backend also leaves an allocated descriptor behind on endpoint parse and interface claim failures.
Junjie Cao (2): usb-host: validate interface number before indexing altsetting usb-host: free configuration descriptors on error paths hw/usb/host-libusb.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) -- 2.43.0
