diff options
| author | Daniel P. Berrangé <berrange@redhat.com> | 2019-04-15 16:45:03 +0100 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2019-05-02 08:29:33 +0200 |
| commit | 1259f27ec2113d34e54ee731aac5990d9606d9fa (patch) | |
| tree | cf27e55f405061bd6d17a7b1ba8bb6e5adb8ac29 /hw/usb/dev-mtp.c | |
| parent | 3541cd48f32233dd0c0766a3f342e3fd64b04381 (diff) | |
| download | focaccia-qemu-1259f27ec2113d34e54ee731aac5990d9606d9fa.tar.gz focaccia-qemu-1259f27ec2113d34e54ee731aac5990d9606d9fa.zip | |
usb-mtp: fix alignment of access of ObjectInfo filename field
The ObjectInfo struct's "filename" field is following a uint8_t field in a packed struct and thus has bad alignment for a 16-bit field. Switch the field to to uint8_t and use the helper function for accessing unaligned 16-bit data. Note that although the MTP spec specifies big endian, when transported over the USB protocol, data is little endian. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-id: 20190415154503.6758-4-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/usb/dev-mtp.c')
| -rw-r--r-- | hw/usb/dev-mtp.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index 6b7d1296e4..963449ec7d 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -226,7 +226,7 @@ typedef struct { uint32_t assoc_desc; uint32_t seq_no; /*unused*/ uint8_t length; /*part of filename field*/ - uint16_t filename[0]; + uint8_t filename[0]; /* UTF-16 encoded */ char date_created[0]; /*unused*/ char date_modified[0]; /*unused*/ char keywords[0]; /*unused*/ @@ -1551,7 +1551,7 @@ static void usb_mtp_cancel_packet(USBDevice *dev, USBPacket *p) fprintf(stderr, "%s\n", __func__); } -static char *utf16_to_str(uint8_t len, uint16_t *arr) +static char *utf16_to_str(uint8_t len, uint8_t *str16) { wchar_t *wstr = g_new0(wchar_t, len + 1); int count, dlen; @@ -1559,7 +1559,7 @@ static char *utf16_to_str(uint8_t len, uint16_t *arr) for (count = 0; count < len; count++) { /* FIXME: not working for surrogate pairs */ - wstr[count] = (wchar_t)arr[count]; + wstr[count] = lduw_le_p(str16 + (count * 2)); } wstr[count] = 0; |