OSDN Git Service

usb-mtp: Limit filename to object information size
authorMichael Hanselmann <public@hansmi.ch>
Thu, 13 Dec 2018 22:37:06 +0000 (22:37 +0000)
committerGerd Hoffmann <kraxel@redhat.com>
Fri, 14 Dec 2018 07:57:17 +0000 (08:57 +0100)
commit90c1a74271ce4667d16eeca575dfa78a6c7d465c
treeeaf9de9bb8605ef17ace6c80cd5fb781f092016d
parentbab9df35ce73d1c8e19a37e2737717ea1c984dc1
usb-mtp: Limit filename to object information size

The filename length in MTP metadata is specified by the guest. By
trusting it directly it'd theoretically be possible to get the host to
write memory parts outside the filename buffer into a filename. In
practice though there are usually NUL bytes stopping the string
operations.

Also use the opportunity to not assign the filename member twice.

Signed-off-by: Michael Hanselmann <public@hansmi.ch>
Message-id: ab70659d8d5c580bdf150a5f7d5cc60c8e374ffc.1544740018.git.public@hansmi.ch

[ kraxel: codestyle fix: break a long line ]

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
hw/usb/dev-mtp.c