Re: [PATCH 2/5] usb/redir: avoid dynamic stack allocation (CVE-2021-3527)

[Philippe Mathieu-Daudé]

On 5/3/21 11:27 AM, Philippe Mathieu-Daudé wrote:
> On 5/3/21 11:14 AM, Gerd Hoffmann wrote:
>> Use autofree heap allocation instead.
>>
>> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> 
> Fixes: 4f4321c11ff ("usb: use iovecs in USBPacket")
> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Hmm there is still another use:

 618         if (dev->endpoint[EP2I(ep)].iso_started) {
 619             struct usb_redir_iso_packet_header iso_packet = {
 620                 .endpoint = ep,
 621                 .length = p->iov.size
 622             };
 623             uint8_t buf[p->iov.size];