From: Gerd Hoffmann <kraxel@redhat.com>
Date: Thu, 12 Dec 2013 13:47:15 +0000 (+0100)
Subject: usb-host: add range checks for usb-host parameters
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=f3cda6e060c483dee1fa497699fd5f972e5031da;p=qemu.git

usb-host: add range checks for usb-host parameters

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---

diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c
index afbf1563f4..33b5b9ff19 100644
--- a/hw/usb/host-libusb.c
+++ b/hw/usb/host-libusb.c
@@ -952,6 +952,19 @@ static int usb_host_initfn(USBDevice *udev)
 {
     USBHostDevice *s = USB_HOST_DEVICE(udev);
 
+    if (s->match.vendor_id > 0xffff) {
+        error_report("vendorid out of range");
+        return -1;
+    }
+    if (s->match.product_id > 0xffff) {
+        error_report("productid out of range");
+        return -1;
+    }
+    if (s->match.addr > 127) {
+        error_report("hostaddr out of range");
+        return -1;
+    }
+
     loglevel = s->loglevel;
     udev->flags |= (1 << USB_DEV_FLAG_IS_HOST);
     udev->auto_attach = 0;