Re: [Qemu-devel] [PATCH for-4.0? 0/3] usb-mtp: fix ObjectInfo request handling

[Peter Maydell]

On Mon, 15 Apr 2019 at 18:10, Eric Blake <address@hidden> wrote:
> On 4/15/19 10:45 AM, Daniel P. Berrangé wrote:
> > The 2nd patch in this series is a security flaw fix since the
> > code was not correctly validating guest provided data length.
>
> Given that this is a security flaw, I've added this series to
> https://wiki.qemu.org/Planning/4.0 in case you're hoping to get it in -rc4.

What are the consequences of the flaw ? IIRC it's only one
extra byte read?

thanks
-- PMM