Re: [PATCH 4/9] hw/usb/dev-mtp: Handle invalid characters in utf16_to_str()

["Tommaso Califano" <tcalifano@redhat.com>]

On Fri Nov 13, 2026 at 9:33 AM CET, marcandre.lureau wrote:
>> wcstombs(NULL, wstr, 0) returns (size_t)-1 when the string contains a
>> character that cannot be converted. The return value was not checked, so
>> dlen + 1 wrapped to 0, g_malloc(0) returned NULL, and
>> usb_mtp_write_metadata() dereferenced it in strchr().
>> 
>> Use size_t, return NULL on conversion failure, and reject the
>> filename in usb_mtp_write_metadata() when that happens.
>> 
>> Cc: qemu-stable@nongnu.org
>> Fixes: 6de02a13232a ("usb-mtp: fix utf16_to_str")
>> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4529
>> Suggested-by: Hui Peng <https://gitlab.com/benquike>
>> Signed-off-by: Tommaso Califano <tcalifano@redhat.com>
>> Message-ID: <20261112174907.158825-5-tcalifano@redhat.com>
>> ---
>>  hw/usb/dev-mtp.c | 15 ++++++++++-----
>>  1 file changed, 10 insertions(+), 5 deletions(-)
>>
>> diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
>> index 1a26f681ce5f..7233470558db 100644
>> --- a/hw/usb/dev-mtp.c
>> +++ b/hw/usb/dev-mtp.c
>> @@ -1563,7 +1563,8 @@ static void usb_mtp_cancel_packet(USBDevice *dev, USBPacket *p)
>>  static char *utf16_to_str(uint8_t len, uint8_t *str16)
>>  {
>>      wchar_t *wstr = g_new0(wchar_t, len + 1);
>> -    int count, dlen;
>> +    int count;
>> +    size_t dlen;
>>      char *dest;
>>  
>>      for (count = 0; count < len; count++) {
>> @@ -1572,9 +1573,13 @@ static char *utf16_to_str(uint8_t len, uint8_t *str16)
>>      }
>>      wstr[count] = 0;
>>  
>> -    dlen = wcstombs(NULL, wstr, 0) + 1;
>> -    dest = g_malloc(dlen);
>> -    wcstombs(dest, wstr, dlen);
>> +    dlen = wcstombs(NULL, wstr, 0);
>
> Can we replace this function with g_utf16_to_utf8() which is not
> sensible to locale. If not, a comment could be useful.

Sure. I wasn’t aware of that function, but it does seem like a perfect
fit. Thanks!

Thanks,
Tommaso