From: Junjie Cao <[email protected]>
usb_host_ep_update() indexes USBDevice.altsetting with the interface
number supplied by the active configuration descriptor. A descriptor
with bInterfaceNumber >= USB_MAX_INTERFACES reads past that array while
the host device is opened. Skip such interfaces before the lookup.
Record the descriptor's interface number on its endpoints as well. The
loop index identifies the descriptor's position in the configuration,
which need not equal bInterfaceNumber.
Fixes: 0dbe4768b95 ("usb-host: use correct altsetting in usb_host_ep_update")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3975
Cc: [email protected]
Signed-off-by: Junjie Cao <[email protected]>
Reviewed-by: Marc-André Lureau <[email protected]>
---
hw/usb/host-libusb.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c
index 629505c6d3..fd4a16ee8a 100644
--- a/hw/usb/host-libusb.c
+++ b/hw/usb/host-libusb.c
@@ -895,6 +895,11 @@ static void usb_host_ep_update(USBHostDevice *s)
* then correct the alternate setting value if necessary.
*/
intf = &conf->interface[i].altsetting[0];
+ if (intf->bInterfaceNumber >= USB_MAX_INTERFACES) {
+ trace_usb_host_parse_error(s->bus_num, s->addr,
+ "invalid interface number");
+ continue;
+ }
alt = udev->altsetting[intf->bInterfaceNumber];
if (alt != 0) {
@@ -930,7 +935,7 @@ static void usb_host_ep_update(USBHostDevice *s)
usb_ep_set_max_packet_size(udev, pid, ep,
endp->wMaxPacketSize);
usb_ep_set_type(udev, pid, ep, type);
- usb_ep_set_ifnum(udev, pid, ep, i);
+ usb_ep_set_ifnum(udev, pid, ep, intf->bInterfaceNumber);
usb_ep_set_halted(udev, pid, ep, 0);
#ifdef HAVE_STREAMS
if (type == LIBUSB_TRANSFER_TYPE_BULK &&
--
2.43.0
