Message ID | jpgr2m8ajfk.fsf_-_@linux.bootlegged.copy (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index 3d59fe4944..28384ea3b0 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -1696,6 +1696,11 @@ static void usb_mtp_get_data(MTPState *s, mtp_container *container, uint64_t dlen; uint32_t data_len = p->iov.size; + if (!d) { + usb_mtp_queue_result(s, RES_INVALID_OBJECTINFO, 0, + 0, 0, 0, 0); + return; + } if (d->first) { /* Total length of incoming data */ d->length = cpu_to_le32(container->length) - sizeof(mtp_container);
CID 1390604 If the initiator sends a packet with TYPE_DATA set without initiating a CMD_GET_OBJECT_INFO first, then usb_mtp_get_data can trip on a null s->data_out. Signed-off-by: Bandan Das <bsd@redhat.com> --- hw/usb/dev-mtp.c | 5 +++++ 1 file changed, 5 insertions(+)