File 0300-usb-ehci-fix-memory-leak-in-ehci_in.patch of Package qemu.4227

Overview Repositories Revisions Requests Users Attributes Meta

File 0300-usb-ehci-fix-memory-leak-in-ehci_in.patch of Package qemu.4227

From cf87516c68258f2a9c1646bc3c211bc3301c7525 Mon Sep 17 00:00:00 2001
From: Li Qiang <liqiang6-s@360.cn>
Date: Tue, 8 Nov 2016 04:11:10 -0800
Subject: [PATCH] usb: ehci: fix memory leak in ehci_init_transfer

In ehci_init_transfer function, if the 'cpage' is bigger than 4,
it doesn't free the 'p->sgl' once allocated previously thus leading
a memory leak issue. This patch avoid this.

Signed-off-by: Li Qiang <liqiang6-s@360.cn>
Message-id: 5821c0f4.091c6b0a.e0c92.e811@mx.google.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 791f97758e223de3290592d169f8e6339c281714)
[BR: CVE-2016-9911 BSC#1014111]
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
 hw/usb/hcd-ehci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index b29dc566cf..13edd2d98e 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1270,6 +1270,7 @@ static int ehci_init_transfer(EHCIPacket *p)
     while (bytes > 0) {
         if (cpage > 4) {
             fprintf(stderr, "cpage out of range (%d)\n", cpage);
+            qemu_sglist_destroy(&p->sgl);
             return -1;
         }

Places

File 0300-usb-ehci-fix-memory-leak-in-ehci_in.patch of Package qemu.4227

Places