File 0105-usb-check-USB-configuration-descrip.patch of Package qemu-linux-user.5922

Overview Repositories Revisions Requests Users Attributes Meta

File 0105-usb-check-USB-configuration-descrip.patch of Package qemu-linux-user.5922

From 87f77425adc0f52e88780dae958f6c75b47f1555 Mon Sep 17 00:00:00 2001
From: Prasad J Pandit <pjp@fedoraproject.org>
Date: Thu, 11 Feb 2016 16:31:20 +0530
Subject: [PATCH] usb: check USB configuration descriptor object

When processing remote NDIS control message packets, the USB Net
device emulator checks to see if the USB configuration descriptor
object is of RNDIS type(2). But it does not check if it is null,
which leads to a null dereference error. Add check to avoid it.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 1455188480-14688-1-git-send-email-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 80eecda8e5d09c442c24307f340840a5b70ea3b9)
[BR: CVE-2016-2392 BSC#967012]
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
 hw/usb/dev-network.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
index 919ba2d38a..baf56b79eb 100644
--- a/hw/usb/dev-network.c
+++ b/hw/usb/dev-network.c
@@ -650,7 +650,8 @@ typedef struct USBNetState {
 
 static int is_rndis(USBNetState *s)
 {
-    return s->dev.config->bConfigurationValue == DEV_RNDIS_CONFIG_VALUE;
+    return s->dev.config ?
+            s->dev.config->bConfigurationValue == DEV_RNDIS_CONFIG_VALUE : 0;
 }
 
 static int ndis_query(USBNetState *s, uint32_t oid,

Places

File 0105-usb-check-USB-configuration-descrip.patch of Package qemu-linux-user.5922

Places