File CVE-2016-2392-qemuu-usb-null-pointer-dereferenc... of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2016-2392-qemuu-usb-null-pointer-dereference-in-NDIS-message-handling.patch of Package xen (Revision dbf2eede0f22d32a0cc48154739aa8fe)

Currently displaying revision dbf2eede0f22d32a0cc48154739aa8fe , Show latest

References: bsc#967090 CVE-2016-2392

When processing remote NDIS control message packets, the USB Net
device emulator checks to see if the USB configuration descriptor
object is of RNDIS type(2). But it does not check if it is null,
which leads to a null dereference error. Add check to avoid it.

Reported-by: Qinghao Tang <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
---
 hw/usb/dev-network.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Index: xen-4.5.2-testing/tools/qemu-xen-dir-remote/hw/usb/dev-network.c
===================================================================
--- xen-4.5.2-testing.orig/tools/qemu-xen-dir-remote/hw/usb/dev-network.c
+++ xen-4.5.2-testing/tools/qemu-xen-dir-remote/hw/usb/dev-network.c
@@ -650,7 +650,8 @@ typedef struct USBNetState {
 
 static int is_rndis(USBNetState *s)
 {
-    return s->dev.config->bConfigurationValue == DEV_RNDIS_CONFIG_VALUE;
+    return s->dev.config ?
+            s->dev.config->bConfigurationValue == DEV_RNDIS_CONFIG_VALUE : 0;
 }
 
 static int ndis_query(USBNetState *s, uint32_t oid,

Places

File CVE-2016-2392-qemuu-usb-null-pointer-dereference-in-NDIS-message-handling.patch of Package xen (Revision dbf2eede0f22d32a0cc48154739aa8fe)

Places