From: Bandan Das <b...@redhat.com>
CID 1390604
If the initiator sends a packet with TYPE_DATA set without
initiating a CMD_GET_OBJECT_INFO first, then usb_mtp_get_data
can trip on a null s->data_out.
Signed-off-by: Bandan Das <b...@redhat.com>
Message-Id: <jpgr2m8ajfk.fsf...@linux.bootlegged.copy>
Signed-off-by: Gerd Hoffmann <kra...@redhat.com>
---
hw/usb/dev-mtp.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index b0ab6a7912..1ded7ac9a3 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -1700,6 +1700,11 @@ static void usb_mtp_get_data(MTPState *s, mtp_container
*container,
uint64_t dlen;
uint32_t data_len = p->iov.size;
+ if (!d) {
+ usb_mtp_queue_result(s, RES_INVALID_OBJECTINFO, 0,
+ 0, 0, 0, 0);
+ return;
+ }
if (d->first) {
/* Total length of incoming data */
d->length = cpu_to_le32(container->length) - sizeof(mtp_container);
--
2.9.3
