[Xen-changelog] [qemu-xen master] usb-mtp: fix alignment of access of ObjectInfo filename field

[patchbot@xxxxxxx]

commit 1bcf484fa9f451cc8c290fe80fd0e764199ca81c
Author:     Daniel P. Berrangé <berrange@xxxxxxxxxx>
AuthorDate: Mon Apr 15 16:45:03 2019 +0100
Commit:     Anthony PERARD <anthony.perard@xxxxxxxxxx>
CommitDate: Fri Jul 26 11:07:32 2019 +0100

    usb-mtp: fix alignment of access of ObjectInfo filename field
    
    The ObjectInfo struct's "filename" field is following a uint8_t
    field in a packed struct and thus has bad alignment for a 16-bit
    field. Switch the field to to uint8_t and use the helper function
    for accessing unaligned 16-bit data.
    
    Note that although the MTP spec specifies big endian, when transported
    over the USB protocol, data is little endian.
    
    Signed-off-by: Daniel P. Berrangé <berrange@xxxxxxxxxx>
    Message-id: 20190415154503.6758-4-berrange@xxxxxxxxxx
    Signed-off-by: Gerd Hoffmann <kraxel@xxxxxxxxxx>
    (cherry picked from commit 1259f27ec2113d34e54ee731aac5990d9606d9fa)
---
 hw/usb/dev-mtp.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index 99548b012d..556d1b9eb7 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -226,7 +226,7 @@ typedef struct {
     uint32_t assoc_desc;
     uint32_t seq_no; /*unused*/
     uint8_t length; /*part of filename field*/
-    uint16_t filename[0];
+    uint8_t filename[0]; /* UTF-16 encoded */
     char date_created[0]; /*unused*/
     char date_modified[0]; /*unused*/
     char keywords[0]; /*unused*/
@@ -1551,7 +1551,7 @@ static void usb_mtp_cancel_packet(USBDevice *dev, 
USBPacket *p)
     fprintf(stderr, "%s\n", __func__);
 }
 
-static char *utf16_to_str(uint8_t len, uint16_t *arr)
+static char *utf16_to_str(uint8_t len, uint8_t *str16)
 {
     wchar_t *wstr = g_new0(wchar_t, len + 1);
     int count, dlen;
@@ -1559,7 +1559,7 @@ static char *utf16_to_str(uint8_t len, uint16_t *arr)
 
     for (count = 0; count < len; count++) {
         /* FIXME: not working for surrogate pairs */
-        wstr[count] = (wchar_t)arr[count];
+        wstr[count] = lduw_le_p(str16 + (count * 2));
     }
     wstr[count] = 0;
 
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog