Author: trasz
Date: Thu May 17 15:19:29 2018
New Revision: 333718
URL: https://svnweb.freebsd.org/changeset/base/333718
Log:
Fix off-by-one in usb_decode_str_desc(). Previously it would decode
one character too many. Note that this function is only used to decode
string descriptors generated by the kernel itself.
Reviewed by: hselasky@
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Modified:
head/sys/dev/usb/template/usb_template.c
Modified: head/sys/dev/usb/template/usb_template.c
==============================================================================
--- head/sys/dev/usb/template/usb_template.c Thu May 17 14:55:41 2018
(r333717)
+++ head/sys/dev/usb/template/usb_template.c Thu May 17 15:19:29 2018
(r333718)
@@ -127,7 +127,12 @@ usb_decode_str_desc(struct usb_string_descriptor *sd,
{
size_t i;
- for (i = 0; i < buflen - 1 && i < sd->bLength / 2; i++)
+ if (sd->bLength < 2) {
+ buf[0] = '\0';
+ return;
+ }
+
+ for (i = 0; i < buflen - 1 && i < (sd->bLength / 2) - 1; i++)
buf[i] = UGETW(sd->bString[i]);
buf[i] = '\0';
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "[email protected]"
