diff mbox

[2/3] usb-host: don't dereference invalid iovecs

Message ID 1334836476-27945-3-git-send-email-kraxel@redhat.com
State New
Headers show

Commit Message

Gerd Hoffmann April 19, 2012, 11:54 a.m. UTC 
usb-host assumes the first iovec element is always valid.
In case of a zero-length packet this isn't true though.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/usb/host-linux.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)
diff mbox

Patch

diff --git a/hw/usb/host-linux.c b/hw/usb/host-linux.c
index 061a1b7..c3684c8 100644
--- a/hw/usb/host-linux.c
+++ b/hw/usb/host-linux.c
@@ -884,16 +884,16 @@  static int usb_host_handle_data(USBDevice *dev, USBPacket *p)
     }
 
     v = 0;
-    prem = p->iov.iov[v].iov_len;
-    pbuf = p->iov.iov[v].iov_base;
+    prem = 0;
+    pbuf = NULL;
     rem = p->iov.size;
     while (rem) {
         if (prem == 0) {
-            v++;
             assert(v < p->iov.niov);
             prem = p->iov.iov[v].iov_len;
             pbuf = p->iov.iov[v].iov_base;
             assert(prem <= rem);
+            v++;
         }
         aurb = async_alloc(s);
         aurb->packet = p;