On Wed, Oct 07, 2026 at 04:37:38PM +0200, Tommaso Califano wrote:
usb_mtp_write_metadata() computed the number of filename characters asfilename_chars = dlen - offsetof(ObjectInfo, filename) where dlen is the amount of data copied by the last USB packet of the transfer, not the size of the ObjectInfo dataset. If the final packet has fewer than 53 bytes, filename_chars underflows to SIZE_MAX, causing utf16_to_str() to read far beyond the heap buffer, leaking QEMU host process memory. Use d->length instead: it is the size of the buffer holding the dataset, and usb_mtp_write_metadata() is only reached once all d->length bytes have been received. d->length is guest-controlled, so reject datasets too small to hold the fixed part of ObjectInfo before dereferencing it. The check is "<=" rather than "<" because a dataset of exactly offsetof(ObjectInfo,filename) bytes would yield an empty filename. Fixes: 90c1a74271ce ("usb-mtp: Limit filename to object information size") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3992 Signed-off-by: Tommaso Califano <[email protected]> ---
Not a USB expert, but this fix LGTM! Reviewed-by: Luigi Leonardi <[email protected]> Thanks, Luigi
