A flaw was found in the USB CCID smartcard reader device emulation (hw/usb/dev-smartcard-reader.c) in QEMU. A guest can submit an interrupt IN transfer shorter than the 2-byte RDR_to_PC_NotifySlotChange message; usb_packet_copy() asserts that the packet has enough space, so a zero- or one-byte request triggers an assertion failure, crashing QEMU. This may result in a denial of service of the QEMU process.