Re: [Qemu-devel] [PATCH 2/3] usb-mtp: fix bounds check for guest provided filename

2019-04-16 Thread Bandan Das
Daniel P. Berrangé writes: > The ObjectInfo struct has a variable length array containing the UTF-16 > encoded filename. The number of characters of trailing data is given by > the 'length' field in the struct and this must be validated against the > size of the data packet received from the gues

[Qemu-devel] [PATCH 2/3] usb-mtp: fix bounds check for guest provided filename

2019-04-15 Thread Daniel P . Berrangé
The ObjectInfo struct has a variable length array containing the UTF-16 encoded filename. The number of characters of trailing data is given by the 'length' field in the struct and this must be validated against the size of the data packet received from the guest. Since the data is UTF-16, we must