Prasad J Pandit a3e8da458c usb: ccid: check ccid apdu length ...

CCID device emulator uses Application Protocol Data Units(APDU)
to exchange command and responses to and from the host.
The length in these units couldn't be greater than 65536. Add
check to ensure the same. It'd also avoid potential integer
overflow in emulated_apdu_from_guest.

Reported-by: Li Qiang <liqiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20170202192228.10847-1-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit c7dfbf3225)
[BR: CVE-2017-5898 BSC#1023907]
Signed-off-by: Bruce Rogers <brogers@suse.com>

2021-03-17 09:45:51 -06:00

..

bus.c

util: move declarations out of qemu-common.h

2016-03-22 22:20:17 +01:00

ccid-card-emulated.c

event-notifier: Add "is_external" parameter

2016-04-22 16:43:56 +02:00

ccid-card-passthru.c

Passthru CCID card: QOMify

2016-02-11 15:15:47 +03:00

ccid.h

hw: move private headers to hw/ subdirectories.

2013-04-08 18:13:16 +02:00

combined-packet.c

usb: Clean up includes

2016-01-29 15:07:23 +00:00

core.c

usb: check RNDIS message length

2016-02-23 10:38:00 +01:00

desc-msos.c

usb: Clean up includes

2016-01-29 15:07:23 +00:00

desc.c

usb: Clean up includes

2016-01-29 15:07:23 +00:00

desc.h

all: Clean up includes

2016-02-23 12:43:05 +00:00

dev-audio.c

usb: Clean up includes

2016-01-29 15:07:23 +00:00

dev-bluetooth.c

usb: Clean up includes

2016-01-29 15:07:23 +00:00

dev-hid.c

include/qemu/osdep.h: Don't include qapi/error.h

2016-03-22 22:20:15 +01:00

dev-hub.c

include/qemu/osdep.h: Don't include qapi/error.h

2016-03-22 22:20:15 +01:00

dev-mtp.c

Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

2016-03-24 21:42:40 +00:00

dev-network.c

util: move declarations out of qemu-common.h

2016-03-22 22:20:17 +01:00

dev-serial.c

util: move declarations out of qemu-common.h

2016-03-22 22:20:17 +01:00

dev-smartcard-reader.c

usb: ccid: check ccid apdu length

2021-03-17 09:45:51 -06:00

dev-storage.c

util: move declarations out of qemu-common.h

2016-03-22 22:20:17 +01:00

dev-uas.c

usb: Clean up includes

2016-01-29 15:07:23 +00:00

dev-wacom.c

usb: Clean up includes

2016-01-29 15:07:23 +00:00

hcd-ehci-pci.c

usb: Clean up includes

2016-01-29 15:07:23 +00:00

hcd-ehci-sysbus.c

usb: Clean up includes

2016-01-29 15:07:23 +00:00

hcd-ehci.c

usb: ehci: fix memory leak in ehci_init_transfer

2021-03-17 09:45:50 -06:00

hcd-ehci.h

Include monitor/monitor.h exactly where needed

2015-06-22 18:20:41 +02:00

hcd-musb.c

Replaced get_tick_per_sec() by NANOSECONDS_PER_SECOND

2016-03-22 22:20:17 +01:00

hcd-ohci.c

usb/ohci: Fix crash with when specifying too many num-ports

2016-08-04 16:43:40 -05:00

hcd-uhci.c

usb/uhci: move pid check

2016-04-25 12:05:05 +01:00

hcd-xhci.c

xhci: limit the number of link trbs we are willing to process

2021-03-17 09:45:50 -06:00

host-legacy.c

usb: Clean up includes

2016-01-29 15:07:23 +00:00

host-libusb.c

include/qemu/osdep.h: Don't include qapi/error.h

2016-03-22 22:20:15 +01:00

host-stub.c

usb: Clean up includes

2016-01-29 15:07:23 +00:00

host.h

usb-host: move legacy cmd line bits

2013-02-19 12:30:05 +01:00

libhw.c

usb: Clean up includes

2016-01-29 15:07:23 +00:00

Makefile.objs

xen: add pvUSB backend

2021-03-17 09:45:49 -06:00

quirks-ftdi-ids.h

usbredir: Add support for buffered bulk input (v2)

2013-01-08 10:56:58 +01:00

quirks-pl2303-ids.h

usbredir: Add support for buffered bulk input (v2)

2013-01-08 10:56:58 +01:00

quirks.c

usb: Clean up includes

2016-01-29 15:07:23 +00:00

quirks.h

usbredir: Add support for buffered bulk input (v2)

2013-01-08 10:56:58 +01:00

redirect.c

usbredir: free vm_change_state_handler in usbredir destroy dispatch

2021-03-17 09:45:50 -06:00

tusb6010.c

Replaced get_tick_per_sec() by NANOSECONDS_PER_SECOND

2016-03-22 22:20:17 +01:00

xen-usb.c

xen: drain submit queue in xen-usb before removing device

2021-03-17 09:45:49 -06:00