Rev | Line | |
---|
[34] | 1 | # HG changeset patch |
---|
| 2 | # User kfraser@localhost.localdomain |
---|
| 3 | # Node ID f19ddc0ee3e68d5d8a250ba0a20ab7d90ae9a36a |
---|
| 4 | # Parent f66f7c3a82a7420d80714b0d349ee9a24b50ec28 |
---|
| 5 | [QEMU] usb-uhci: Data buffer is too small |
---|
| 6 | |
---|
| 7 | The data buffer is only 1280 bytes long but the user-supplied length |
---|
| 8 | can be as large as 0x7ff. This patch extends the buffer to 2048 |
---|
| 9 | bytes. |
---|
| 10 | |
---|
| 11 | Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> |
---|
| 12 | |
---|
| 13 | Index: ioemu/hw/usb-uhci.c |
---|
| 14 | =================================================================== |
---|
| 15 | --- ioemu.orig/hw/usb-uhci.c 2006-12-08 18:21:36.000000000 +0000 |
---|
| 16 | +++ ioemu/hw/usb-uhci.c 2006-12-08 18:23:06.000000000 +0000 |
---|
| 17 | @@ -421,7 +421,7 @@ |
---|
| 18 | static int uhci_handle_td(UHCIState *s, UHCI_TD *td, int *int_mask) |
---|
| 19 | { |
---|
| 20 | uint8_t pid; |
---|
| 21 | - uint8_t buf[1280]; |
---|
| 22 | + uint8_t buf[2048]; |
---|
| 23 | int len, max_len, err, ret; |
---|
| 24 | |
---|
| 25 | if (td->ctrl & TD_CTRL_IOC) { |
---|
Note: See
TracBrowser
for help on using the repository browser.