QEMU · usb-ccid
QEMU usb-ccid: out-of-bounds read
A guest can fill the pending bulk-in ring, partially read a slot, then reuse it with a stale cursor. The unsigned length subtraction wraps and reads past data[].
QEMU · usb-ccid
A guest can fill the pending bulk-in ring, partially read a slot, then reuse it with a stale cursor. The unsigned length subtraction wraps and reads past data[].