canokey_handle_data() takes the endpoint number from the USB packet
(p->ep->nr, guest-selectable 1..15) and uses it to index the fixed-size
ep_out[] / ep_out_size[] arrays of CanoKeyState, which hold only
CANOKEY_EP_NUM = 3 entries.  A forged bulk-OUT transfer on any endpoint
number >= 3 therefore reads a bogus length from past ep_out_size[] and
writes guest data through a wild pointer read from past ep_out[].

Validate p->ep->nr against CANOKEY_EP_NUM and return USB_RET_STALL for
invalid endpoints, before any array access.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4481
Signed-off-by: Bin Guo <guobin@linux.alibaba.com>
---
 hw/usb/canokey.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/usb/canokey.c b/hw/usb/canokey.c
index c3baedac2c..91dd886761 100644
--- a/hw/usb/canokey.c
+++ b/hw/usb/canokey.c
@@ -189,6 +189,11 @@ static void canokey_handle_data(USBDevice *dev, USBPacket *p)
 {
     CanoKeyState *key = CANOKEY(dev);
 
+    if (p->ep->nr >= CANOKEY_EP_NUM) {
+        p->status = USB_RET_STALL;
+        return;
+    }
+
     uint8_t ep_in = CANOKEY_EP_IN(p->ep->nr);
     uint8_t ep_out = p->ep->nr;
     uint32_t in_len;
-- 
2.50.1 (Apple Git-155)