The libusb host backend reads interface numbers from the active configuration descriptor while opening a device. An out-of-range number can index past USBDevice.altsetting. The backend also leaves an allocated descriptor behind on endpoint parse and interface claim failures.
Changes in v2: - Use g_autoptr for configuration descriptors in usb_host_ep_update() and usb_host_claim_interfaces() (Marc-André). - Collected tags from Marc-André. v1: https://lore.kernel.org/qemu-devel/[email protected]/ Junjie Cao (2): usb-host: validate interface number before indexing altsetting usb-host: free configuration descriptors on error paths hw/usb/host-libusb.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) base-commit: d7a65d1793d691d356a56833620f7d1e6f5d653b -- 2.43.0
