OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 6 Pull Requests Projects 2 Releases Activity

dev-mtp: fix buffer allocation for writing file contents

Browse Source 
usb_mtp_realloc() was being incorrectly used when allocating
buffer for incoming data. Set d->length only after resizing
the buffer.

Signed-off-by: Bandan Das <bsd@redhat.com>
Message-id: 20180720214020.22897-3-bsd@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Bandan Das 2018-07-20 17:40:17 -04:00 committed by Gerd Hoffmann
parent 47bff13cea
commit 406f35d7fc
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hw/usb/dev-mtp.c
View File

@ -1721,6 +1721,7 @@ static void usb_mtp_get_data(MTPState *s, mtp_container *container,
MTPData *d = s->data_out;
uint64_t dlen;
uint32_t data_len = p->iov.size;
uint64_t total_len;
if (!d) {
usb_mtp_queue_result(s, RES_INVALID_OBJECTINFO, 0,
@ -1729,10 +1730,11 @@ static void usb_mtp_get_data(MTPState *s, mtp_container *container,
}
if (d->first) {
/* Total length of incoming data */
d->length = cpu_to_le32(container->length) - sizeof(mtp_container);
total_len = cpu_to_le32(container->length) - sizeof(mtp_container);
/* Length of data in this packet */
data_len -= sizeof(mtp_container);
usb_mtp_realloc(d, d->length);
usb_mtp_realloc(d, total_len);
d->length += total_len;
d->offset = 0;
d->first = false;
}