Changeset 87119 in vbox for trunk/src/VBox/Devices/Storage

Timestamp:

Dec 24, 2020 10:13:26 AM (4 years ago)

Author:

vboxsync

Message:

UsbMsd: Reject more invalid CBWs (see bugref:9862).

File:

• trunk/src/VBox/Devices/Storage/UsbMsd.cpp (modified) (2 diffs)

trunk/src/VBox/Devices/Storage/UsbMsd.cpp

@@ -887 +887 @@
 {
     /* Copy the CBW */
-    size_t cbCopy = RT_UOFFSETOF_DYN(USBCBW, CBWCB[pCbw->bCBWCBLength]);
+    uint8_t bCBWLen = RT_MIN(pCbw->bCBWCBLength, sizeof(pCbw->CBWCB));
+    size_t cbCopy = RT_UOFFSETOF_DYN(USBCBW, CBWCB[bCBWLen]);
     memcpy(&pReq->Cbw, pCbw, cbCopy);
     memset((uint8_t *)&pReq->Cbw + cbCopy, 0, sizeof(pReq->Cbw) - cbCopy);
@@ -1622 +1623 @@
                 return usbMsdCompleteStall(pThis, NULL, pUrb, "Bad CBW");
             }
-            if (pCbw->bCBWCBLength == 0)
+            if ((pCbw->bCBWCBLength == 0) || (pCbw->bCBWCBLength > sizeof(pCbw->CBWCB)))
             {
                 Log(("usbMsd: CBW: Bad bCBWCBLength value: %#x\n", pCbw->bCBWCBLength));