diff options
| author | Andrew Scull | 2022-04-03 10:39:11 +0000 |
|---|---|---|
| committer | Tom Rini | 2022-04-29 11:11:36 -0400 |
| commit | 62120155b67313509b673e051155075383a8a33a (patch) | |
| tree | be9aa0846e9cc1b37f7bed6e7f897f8a2664e067 /drivers/usb/emul | |
| parent | 9c2f5ecd43ee8bad9d52497c154088c6a99e3f9d (diff) | |
usb: sandbox: Check for string end in copy_to_unicode()
When copying the string in copy_to_unicode(), check for the null
terminator in each position, not just at the start, to avoid reading
beyond the end of the string.
Signed-off-by: Andrew Scull <ascull@google.com>
Cc: Simon Glass <sjg@chromium.org>
Cc: Marek Vasut <marex@denx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
Diffstat (limited to 'drivers/usb/emul')
| -rw-r--r-- | drivers/usb/emul/usb-emul-uclass.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/usb/emul/usb-emul-uclass.c b/drivers/usb/emul/usb-emul-uclass.c index 05f6d3d9e2f..b31dc950e3a 100644 --- a/drivers/usb/emul/usb-emul-uclass.c +++ b/drivers/usb/emul/usb-emul-uclass.c @@ -15,13 +15,12 @@ static int copy_to_unicode(char *buff, int length, const char *str) { int ptr; - int i; if (length < 2) return 0; buff[1] = USB_DT_STRING; - for (ptr = 2, i = 0; ptr + 1 < length && *str; i++, ptr += 2) { - buff[ptr] = str[i]; + for (ptr = 2; ptr + 1 < length && *str; str++, ptr += 2) { + buff[ptr] = *str; buff[ptr + 1] = 0; } buff[0] = ptr; |