[to-be-updated] lib-string_helpers-fix-counting-of-remaining-bytes-in-string_unescape.patch removed from -mm tree

[Andrew Morton <akpm@linux-foundation.org>]

The quilt patch titled
     Subject: lib/string_helpers: fix counting of remaining bytes in string_unescape()
has been removed from the -mm tree.  Its filename was
     lib-string_helpers-fix-counting-of-remaining-bytes-in-string_unescape.patch

This patch was dropped because an updated version will be issued

------------------------------------------------------
From: Jonas Rebmann <jre@pengutronix.de>
Subject: lib/string_helpers: fix counting of remaining bytes in string_unescape()
Date: Wed, 16 Sep 2026 19:38:10 +0200

All of the available sequences expand to exactly one byte, the size check
in the loop condition is sufficient for the case of an escaped character
too.

Otherwise, an escape sequence that should be unescaped to the last
character before terminating with null in the destination buffer will be
output as backslash instead of the escaped character.

The only exception is when encountering a backslash that turns out to not
start a valid escape sequence and both the backslash and the character
following are handled in one iteration.  Move the check there.

Add a kunit regression-test that unescapes a character to right in front
of the null terminator of the destination buffer.

Link: https://lore.kernel.org/20260916-string_unescape-v1-5-7f8bd986fa33@pengutronix.de
Fixes: 16c7fa05829e ("lib/string_helpers: introduce generic string_unescape")
Signed-off-by: Jonas Rebmann <jre@pengutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Shevchenko <andy@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Sascha Hauer <kernel@pengutronix.de>
---

 lib/string_helpers.c             |    5 +++--
 lib/tests/string_helpers_kunit.c |    2 ++
 2 files changed, 5 insertions(+), 2 deletions(-)

--- a/lib/string_helpers.c~lib-string_helpers-fix-counting-of-remaining-bytes-in-string_unescape
+++ a/lib/string_helpers.c
@@ -329,7 +329,7 @@ int string_unescape(char *src, char *dst
 		size = SIZE_MAX;
 
 	while (*src && --size) {
-		if (src[0] == '\\' && src[1] != '\0' && size > 1) {
+		if (src[0] == '\\' && src[1] != '\0') {
 			src++;
 
 			if (flags & UNESCAPE_SPACE &&
@@ -349,7 +349,8 @@ int string_unescape(char *src, char *dst
 				continue;
 
 			*out++ = '\\';
-			size--;
+			if (!--size)
+				break;
 		}
 		*out++ = *src++;
 	}
--- a/lib/tests/string_helpers_kunit.c~lib-string_helpers-fix-counting-of-remaining-bytes-in-string_unescape
+++ a/lib/tests/string_helpers_kunit.c
@@ -626,6 +626,8 @@ static void test_unescape(struct kunit *
 
 	test_string_unescape_one(test, "short buffer", UNESCAPE_HEX, "\\x41\\x41B", 4, "AAB", 3);
 	test_string_unescape_one(test, "unrecognized escape at end", UNESCAPE_HEX, "B\\qX", 4, "B\\q", 3);
+
+	test_string_unescape_one(test, "end of buffer", UNESCAPE_HEX, "B\\x41", 3, "BA", 2);
 }
 
 static void test_escape(struct kunit *test)
_

Patches currently in -mm which might be from jre@pengutronix.de are