From 62120155b67313509b673e051155075383a8a33a Mon Sep 17 00:00:00 2001 From: Andrew Scull Date: Sun, 3 Apr 2022 10:39:11 +0000 Subject: [PATCH] usb: sandbox: Check for string end in copy_to_unicode() When copying the string in copy_to_unicode(), check for the null terminator in each position, not just at the start, to avoid reading beyond the end of the string. Signed-off-by: Andrew Scull Cc: Simon Glass Cc: Marek Vasut Reviewed-by: Simon Glass --- drivers/usb/emul/usb-emul-uclass.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/emul/usb-emul-uclass.c b/drivers/usb/emul/usb-emul-uclass.c index 05f6d3d9e2..b31dc950e3 100644 --- a/drivers/usb/emul/usb-emul-uclass.c +++ b/drivers/usb/emul/usb-emul-uclass.c @@ -15,13 +15,12 @@ static int copy_to_unicode(char *buff, int length, const char *str) { int ptr; - int i; if (length < 2) return 0; buff[1] = USB_DT_STRING; - for (ptr = 2, i = 0; ptr + 1 < length && *str; i++, ptr += 2) { - buff[ptr] = str[i]; + for (ptr = 2; ptr + 1 < length && *str; str++, ptr += 2) { + buff[ptr] = *str; buff[ptr + 1] = 0; } buff[0] = ptr; -- 2.39.5