diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2018-12-03 19:57:59 +0000 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2018-12-03 19:57:59 +0000 |
| commit | 933cc4bb3469b82be2a2095523df400973aa4790 (patch) | |
| tree | e1f1d6ea088e8b7a6b5a7799441c71e3fd19addf | |
| parent | 9225cd127dd885112787d0dafd7d8aea71e223b4 (diff) | |
| parent | c52d46e041b42bb1ee6f692e00a0abe37a9659f6 (diff) | |
| download | qemu-933cc4bb3469b82be2a2095523df400973aa4790.tar.gz | |
Merge remote-tracking branch 'remotes/kraxel/tags/fixes-31-20181203-pull-request' into staging
usb: mtp fixes.
# gpg: Signature made Mon 03 Dec 2018 19:50:26 GMT
# gpg: using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138
* remotes/kraxel/tags/fixes-31-20181203-pull-request:
usb-mtp: outlaw slashes in filenames
usb-mtp: fix utf16_to_str
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | hw/usb/dev-mtp.c | 24 |
1 files changed, 18 insertions, 6 deletions
diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index 00a3691bae..100b7171f4 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -1593,17 +1593,23 @@ static void usb_mtp_cancel_packet(USBDevice *dev, USBPacket *p) fprintf(stderr, "%s\n", __func__); } -static void utf16_to_str(uint8_t len, uint16_t *arr, char *name) +static char *utf16_to_str(uint8_t len, uint16_t *arr) { - int count; - wchar_t *wstr = g_new0(wchar_t, len); + wchar_t *wstr = g_new0(wchar_t, len + 1); + int count, dlen; + char *dest; for (count = 0; count < len; count++) { + /* FIXME: not working for surrogate pairs */ wstr[count] = (wchar_t)arr[count]; } + wstr[count] = 0; - wcstombs(name, wstr, len); + dlen = wcstombs(NULL, wstr, 0) + 1; + dest = g_malloc(dlen); + wcstombs(dest, wstr, dlen); g_free(wstr); + return dest; } /* Wrapper around write, returns 0 on failure */ @@ -1703,7 +1709,7 @@ static void usb_mtp_write_metadata(MTPState *s) { MTPData *d = s->data_out; ObjectInfo *dataset = (ObjectInfo *)d->data; - char *filename = g_new0(char, dataset->length); + char *filename; MTPObject *o; MTPObject *p = usb_mtp_object_lookup(s, s->dataset.parent_handle); uint32_t next_handle = s->next_handle; @@ -1711,7 +1717,13 @@ static void usb_mtp_write_metadata(MTPState *s) assert(!s->write_pending); assert(p != NULL); - utf16_to_str(dataset->length, dataset->filename, filename); + filename = utf16_to_str(dataset->length, dataset->filename); + + if (strchr(filename, '/')) { + usb_mtp_queue_result(s, RES_PARAMETER_NOT_SUPPORTED, d->trans, + 0, 0, 0, 0); + return; + } o = usb_mtp_object_lookup_name(p, filename, dataset->length); if (o != NULL) { |