From 40e49e4fab60b3b323263f06b7a8385fa9b62e89 Mon Sep 17 00:00:00 2001

From: "Michael S. Tsirkin" <mst@redhat.com>

Date: Tue, 13 May 2014 12:33:16 +0300

Subject: [PATCH] usb: fix up post load checks

Correct post load checks:

1. dev->setup_len == sizeof(dev->data_buf)

    seems fine, no need to fail migration

2. When state is DATA, passing index > len

   will cause memcpy with negative length,

   resulting in heap overflow

First of the issues was reported by dgilbert.

Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

Signed-off-by: Juan Quintela <quintela@redhat.com>

(cherry picked from commit 719ffe1f5f72b1c7ace4afe9ba2815bcb53a829e)

---

 hw/usb/bus.c | 4 ++--

 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/usb/bus.c b/hw/usb/bus.c

index e48b19f..ff1dfe6 100644

--- a/hw/usb/bus.c

+++ b/hw/usb/bus.c

@@ -51,8 +51,8 @@ static int usb_device_post_load(void *opaque, int version_id)

     }

     if (dev->setup_index < 0 ||

         dev->setup_len < 0 ||

-        dev->setup_index >= sizeof(dev->data_buf) ||

-        dev->setup_len >= sizeof(dev->data_buf)) {

+        dev->setup_index > dev->setup_len ||

+        dev->setup_len > sizeof(dev->data_buf)) {

         return -EINVAL;

     }

     return 0;