usb/80773: "usbd_get_string()" could have taken a length parameter

[Hans Petter Selasky]

>Number:         80773
>Category:       usb
>Synopsis:       "usbd_get_string()" could have taken a length parameter
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    freebsd-usb
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun May 08 13:50:01 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     HPS
>Release:        FreeBSD 6.0-CURRENT i386
>Organization:
>Environment:
System: FreeBSD 6.0-CURRENT FreeBSD 6.0-CURRENT #45: Mon Mar 21 15:40:17 CET 
2005 root@:/usr/obj/usr/src/sys/custom i386

>Description:

>How-To-Repeat:

>Fix:

example + extra comments:

/* Use "usbd_get_string_any()" instead of
 * "usbd_get_string_desc()", when the language id is not known. The
 * maximum length of the string, "len", includes the terminating zero.
 * "usbd_get_string_any()" will always write a terminating zero to "buf",
 * also on error.
 */
usbd_status
usbd_get_string(struct usbd_device *udev, int si, char *buf, int len)
{

...

 if(len == 0)
 {
  return (USBD_NORMAL_COMPLETION);
 }

 buf[0] = 0;

 /* subtract the terminating zero */
 len--;

...

 for(i = 0; (i < n) && len; i++, len--)
 {

...
}
>Release-Note:
>Audit-Trail:
>Unformatted: