diff mbox

usb: check USB configuration descriptor object

Message ID 1455188480-14688-1-git-send-email-ppandit@redhat.com
State New
Headers show

Commit Message

Prasad Pandit Feb. 11, 2016, 11:01 a.m. UTC 
From: Prasad J Pandit <pjp@fedoraproject.org>

When processing remote NDIS control message packets, the USB Net
device emulator checks to see if the USB configuration descriptor
object is of RNDIS type(2). But it does not check if it is null,
which leads to a null dereference error. Add check to avoid it.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/usb/dev-network.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Gerd Hoffmann Feb. 16, 2016, 1:34 p.m. UTC | #1 
On Do, 2016-02-11 at 16:31 +0530, P J P wrote:
> When processing remote NDIS control message packets, the USB Net
> device emulator checks to see if the USB configuration descriptor
> object is of RNDIS type(2). But it does not check if it is null,
> which leads to a null dereference error. Add check to avoid it.

Added to usb queue.

thanks,
  Gerd
diff mbox

Patch

diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
index ba3c7a7..180adce 100644
--- a/hw/usb/dev-network.c
+++ b/hw/usb/dev-network.c
@@ -653,7 +653,8 @@  typedef struct USBNetState {
 
 static int is_rndis(USBNetState *s)
 {
-    return s->dev.config->bConfigurationValue == DEV_RNDIS_CONFIG_VALUE;
+    return s->dev.config ?
+            s->dev.config->bConfigurationValue == DEV_RNDIS_CONFIG_VALUE : 0;
 }
 
 static int ndis_query(USBNetState *s, uint32_t oid,