Code:  static int ohci_bus_start(OHCIState *ohci)
 {
    ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
                    ohci_frame_boundary,
                    ohci);
    if (ohci->eof_timer == NULL) {
        trace_usb_ohci_bus_eof_timer_failed(ohci->name);
        ohci_die(ohci);
        return 0;
    }
     trace_usb_ohci_start(ohci->name);
 
     /* Delay the first SOF event by one frame time as

    if (ohci->eof_timer == NULL) {
        trace_usb_ohci_bus_eof_timer_failed(ohci->name);
        ohci_die(ohci);
        return 0;
    }

    trace_usb_ohci_start(ohci->name);

    /* Delay the first SOF event by one frame time as
 static void ohci_bus_stop(OHCIState *ohci)
 {
     trace_usb_ohci_stop(ohci->name);
    if (ohci->eof_timer) {
        timer_del(ohci->eof_timer);
        timer_free(ohci->eof_timer);
    }
    ohci->eof_timer = NULL;
 }
 
 /* Sets a flag in a port status register but only set it if the port is
}

Vulnerability Type: DoS
CWE ID: 
Summary: The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.
Commit Message: 