[PATCH 01/27] hw/usb/dev-smartcard-reader: validate interrupt transfer length

A guest can submit an interrupt IN transfer shorter than the 2-byte
RDR_to_PC_NotifySlotChange message. usb_packet_copy() asserts that
the packet has enough space, so a zero- or one-byte request triggers
an assertion failure, crashing QEMU.

Check the transfer length before copying and stall the endpoint when
it is too short. The notification is preserved for a subsequent
properly-sized transfer.

Note: a later refactoring patch will switch to usb_packet_size(), but
this patch open-code p->iov.size for consistency with the rest of the
code.

Fixes: CVE-2026-18609
Fixes: 367071447ec5 ("usb-ccid: add CCID bus")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4128
Signed-off-by: Marc-André Lureau <[email protected]>
---
 hw/usb/dev-smartcard-reader.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index 964c142d1066..bba97a2b19e6 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -1122,6 +1122,10 @@ static void ccid_handle_data(USBDevice *dev, USBPacket *p)
             break;
         case CCID_INT_IN_EP:
             if (s->notify_slot_change) {
+                if (p->iov.size < 2) {
+                    p->status = USB_RET_STALL;
+                    break;
+                }
                 /* page 56, RDR_to_PC_NotifySlotChange */
                 buf[0] = CCID_MESSAGE_TYPE_RDR_to_PC_NotifySlotChange;
                 buf[1] = s->bmSlotICCState;

-- 
2.55.0