Prasad J Pandit fe3c546c5f usb: check RNDIS buffer offsets & length ...

When processing remote NDIS control message packets,
the USB Net device emulator uses a fixed length(4096) data buffer.
The incoming informationBufferOffset & Length combination could
overflow and cross that range. Check control message buffer
offsets and length to avoid it.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 1455648821-17340-3-git-send-email-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

2016-02-23 10:38:01 +01:00

..

bus.c

…

ccid-card-emulated.c

Emulated CCID card: QOMify

2016-02-11 15:15:46 +03:00

ccid-card-passthru.c

Passthru CCID card: QOMify

2016-02-11 15:15:47 +03:00

ccid.h

…

combined-packet.c

…

core.c

usb: check RNDIS message length

2016-02-23 10:38:00 +01:00

desc-msos.c

…

desc.c

…

desc.h

…

dev-audio.c

…

dev-bluetooth.c

…

dev-hid.c

…

dev-hub.c

…

dev-mtp.c

…

dev-network.c

usb: check RNDIS buffer offsets & length

2016-02-23 10:38:01 +01:00

dev-serial.c

…

dev-smartcard-reader.c

…

dev-storage.c

qom: Swap 'name' next to visitor in ObjectPropertyAccessor

2016-02-08 17:29:56 +01:00

dev-uas.c

…

dev-wacom.c

…

hcd-ehci-pci.c

…

hcd-ehci-sysbus.c

…

hcd-ehci.c

ehci: update irq on reset

2016-02-02 14:11:01 +01:00

hcd-ehci.h

…

hcd-musb.c

…

hcd-ohci.c

…

hcd-uhci.c

…

hcd-xhci.c

…

host-legacy.c

…

host-libusb.c

…

host-stub.c

…

host.h

…

libhw.c

…

Makefile.objs

tusb6010: move from hw/timer to hw/usb

2016-02-23 10:38:00 +01:00

quirks-ftdi-ids.h

…

quirks-pl2303-ids.h

…

quirks.c

…

quirks.h

…

redirect.c

…

tusb6010.c

tusb6010: move from hw/timer to hw/usb

2016-02-23 10:38:00 +01:00