In QEMU's USB redirection (usbredir) implementation (hw/usb/redirect.c), a malicious usbredir peer can send an ep_info message that resets max_packet_size to 0 after bulk receiving
has already started. This leads to multiple exploitable conditions: (1) an infinite loop in usbredir_buffered_bulk_packet() where the splitting loop increments by max_packet_size (0
) and never progresses, (2) a SIGFPE (floating point exception) in usbredir_buffered_bulk_in_complete_ftdi() from a modulo-by-zero operation, and (3) a SIGFPE in usbredir_handle_
buffered_bulk_in_data() from a division-by-zero when computing bytes_per_transfer. A malicious USB redirection peer can exploit this to crash the QEMU process (denial of service) or
cause it to hang indefinitely. Fixed in QEMU v11.0.3 and v10.0.12.