commit f3cda6e060c483dee1fa497699fd5f972e5031da
author Gerd Hoffmann <kraxel@redhat.com> Thu Dec 12 14:47:15 2013 +0100
committer Gerd Hoffmann <kraxel@redhat.com> Fri Jun 13 12:34:57 2014 +0200
tree 12aec12d59ffc4a788a781a5834fad94337b9cb5
parent 2a2c4830c0068d70443f3dddc4cc668f0c601b5c

usb-host: add range checks for usb-host parameters

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

hw/usb/host-libusb.c

diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c
index afbf156..33b5b9f 100644
--- a/hw/usb/host-libusb.c
+++ b/hw/usb/host-libusb.c
@@ -952,6 +952,19 @@
 {
     USBHostDevice *s = USB_HOST_DEVICE(udev);
 
+    if (s->match.vendor_id > 0xffff) {
+        error_report("vendorid out of range");
+        return -1;
+    }
+    if (s->match.product_id > 0xffff) {
+        error_report("productid out of range");
+        return -1;
+    }
+    if (s->match.addr > 127) {
+        error_report("hostaddr out of range");
+        return -1;
+    }
+
     loglevel = s->loglevel;
     udev->flags |= (1 << USB_DEV_FLAG_IS_HOST);
     udev->auto_attach = 0;