Hi,
While tackling some CVEs issues, I also found several correctness and
robustness improvements/fixes. The series:
- has 3 CVE fixes (OOB/assert)
- fixes xHCI compatibility
- some endianness fixes
- blocks & fixes migration
- better spec compliancy
Tested on Linux with pcscd and Windows with OpenSC.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
Marc-André Lureau (27):
hw/usb/dev-smartcard-reader: validate interrupt transfer length
hw/usb/dev-smartcard-reader: fix OOB read from pending bulk-in ring
hw/usb/dev-smartcard-reader: fix assert on pending answers overflow
hw/usb/dev-smartcard-reader: decode bulk-out length as little-endian
hw/usb/dev-smartcard-reader: fix dwMaxCCIDMessageLength descriptor
hw/usb/dev-smartcard-reader: fix OOB read in atr_get_protocol_num()
hw/usb/dev-smartcard-reader: block migration with pending queues
hw/usb/dev-smartcard-reader: drop needless state fields
hw/usb/dev-smartcard-reader: validate migrated fields in post_load
hw/usb/dev-smartcard-reader: reset all I/O state on device reset
hw/usb/dev-smartcard-reader: apply backpressure to bulk-out
hw/usb/dev-smartcard-reader: fix RDR_to_PC_Parameters dwLength
hw/usb/dev-smartcard-reader: reject oversized responses safely
hw/usb/dev-smartcard-reader: release short bulk-in responses with xHCI
hw/usb/dev-smartcard-reader: drop current_bulk_in pointer
hw/usb/dev-smartcard-reader: derive queue counts from start/end indices
hw/usb/dev-smartcard-reader: fix pending queue migration
hw/usb/dev-smartcard-reader: handle Secure, Escape and SetDataRate commands
hw/usb/dev-smartcard-reader: reject commands for invalid slots
hw/usb/dev-smartcard-reader: zero bChainParameter in DataBlock responses
hw/usb/dev-smartcard-reader: report error on XfrBlock with no card
hw/usb/dev-smartcard-reader: stop advertising PIN support
hw/usb/dev-smartcard-reader: validate per-command dwLength
hw/usb/dev-smartcard-reader: use usb_packet_size() accessor
hw/usb/dev-smartcard-reader: advertise T=1 protocol support
hw/usb/dev-smartcard-reader: correct CCID_IccPowerOff
hw/usb/ccid-card-emulated: free libcacard context
hw/core/machine.c | 4 +
hw/usb/ccid-card-emulated.c | 2 +
hw/usb/dev-smartcard-reader.c | 523 ++++++++++++++++++++++++++++++++++--------
3 files changed, 428 insertions(+), 101 deletions(-)
---
base-commit: 3e3ccab106f879b1512f8e0d51a827dd4de30e22
change-id: 20260805-smartcard-fixes-1df707e447ab
Best regards,
--
Marc-André Lureau <marcandre.lureau@redhat.com>