svn commit: r333718 - head/sys/dev/usb/template

[Edward Tomasz Napierala]

Author: trasz
Date: Thu May 17 15:19:29 2018
New Revision: 333718
URL: https://svnweb.freebsd.org/changeset/base/333718

Log:
  Fix off-by-one in usb_decode_str_desc().  Previously it would decode
  one character too many.  Note that this function is only used to decode
  string descriptors generated by the kernel itself.
  
  Reviewed by:	hselasky@
  MFC after:	2 weeks
  Sponsored by:	The FreeBSD Foundation

Modified:
  head/sys/dev/usb/template/usb_template.c

Modified: head/sys/dev/usb/template/usb_template.c
==============================================================================
--- head/sys/dev/usb/template/usb_template.c	Thu May 17 14:55:41 2018	(r333717)
+++ head/sys/dev/usb/template/usb_template.c	Thu May 17 15:19:29 2018	(r333718)
@@ -127,7 +127,12 @@ usb_decode_str_desc(struct usb_string_descriptor *sd, 
 {
 	size_t i;
 
-	for (i = 0; i < buflen - 1 && i < sd->bLength / 2; i++)
+	if (sd->bLength < 2) {
+		buf[0] = '\0';
+		return;
+	}
+
+	for (i = 0; i < buflen - 1 && i < (sd->bLength / 2) - 1; i++)
 		buf[i] = UGETW(sd->bString[i]);
 
 	buf[i] = '\0';