|
 |
54cb13 |
From: Prasad J Pandit <pjp@fedoraproject.org>
|
|
|
54cb13 |
Date: Thu, 11 Feb 2016 16:31:20 +0530
|
|
|
54cb13 |
Subject: [PATCH] usb: check USB configuration descriptor object
|
|
|
54cb13 |
|
|
|
54cb13 |
When processing remote NDIS control message packets, the USB Net
|
|
|
54cb13 |
device emulator checks to see if the USB configuration descriptor
|
|
|
54cb13 |
object is of RNDIS type(2). But it does not check if it is null,
|
|
|
54cb13 |
which leads to a null dereference error. Add check to avoid it.
|
|
|
54cb13 |
|
|
|
54cb13 |
Reported-by: Qinghao Tang <luodalongde@gmail.com>
|
|
|
54cb13 |
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
|
|
|
54cb13 |
Message-id: 1455188480-14688-1-git-send-email-ppandit@redhat.com
|
|
|
54cb13 |
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
54cb13 |
(cherry picked from commit 80eecda8e5d09c442c24307f340840a5b70ea3b9)
|
|
|
54cb13 |
---
|
|
|
54cb13 |
hw/usb/dev-network.c | 3 ++-
|
|
|
54cb13 |
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
54cb13 |
|
|
|
54cb13 |
diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
|
|
|
54cb13 |
index ba3c7a7..180adce 100644
|
|
|
54cb13 |
--- a/hw/usb/dev-network.c
|
|
|
54cb13 |
+++ b/hw/usb/dev-network.c
|
|
|
54cb13 |
@@ -653,7 +653,8 @@ typedef struct USBNetState {
|
|
|
54cb13 |
|
|
|
54cb13 |
static int is_rndis(USBNetState *s)
|
|
|
54cb13 |
{
|
|
|
54cb13 |
- return s->dev.config->bConfigurationValue == DEV_RNDIS_CONFIG_VALUE;
|
|
|
54cb13 |
+ return s->dev.config ?
|
|
|
54cb13 |
+ s->dev.config->bConfigurationValue == DEV_RNDIS_CONFIG_VALUE : 0;
|
|
|
54cb13 |
}
|
|
|
54cb13 |
|
|
|
54cb13 |
static int ndis_query(USBNetState *s, uint32_t oid,
|