| Message ID | 20190415154503.6758-2-berrange@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | usb-mtp: fix ObjectInfo request handling | expand |
Daniel P. Berrangé <berrange@redhat.com> writes: > The ObjectInfo 'length' field provides the length of the > wide character string filename. This is then converted to > a multi-byte character string. This may have a different > byte count to the wide character string. We should use the > C string length of the multi-byte string instead. > > Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> > --- > hw/usb/dev-mtp.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c > index ebf210fbf8..838cd74da6 100644 > --- a/hw/usb/dev-mtp.c > +++ b/hw/usb/dev-mtp.c > @@ -1714,7 +1714,7 @@ static void usb_mtp_write_metadata(MTPState *s, uint64_t dlen) > return; > } > > - o = usb_mtp_object_lookup_name(p, filename, dataset->length); > + o = usb_mtp_object_lookup_name(p, filename, -1); Nit: Might as well just remove the "-1" argument and unconditionally use strlen in usb_mtp_object_lookup_name Bandan > if (o != NULL) { > next_handle = o->handle; > }
diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index ebf210fbf8..838cd74da6 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -1714,7 +1714,7 @@ static void usb_mtp_write_metadata(MTPState *s, uint64_t dlen) return; } - o = usb_mtp_object_lookup_name(p, filename, dataset->length); + o = usb_mtp_object_lookup_name(p, filename, -1); if (o != NULL) { next_handle = o->handle; }
The ObjectInfo 'length' field provides the length of the wide character string filename. This is then converted to a multi-byte character string. This may have a different byte count to the wide character string. We should use the C string length of the multi-byte string instead. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> --- hw/usb/dev-mtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)