1 files changed, 21 insertions, 16 deletions

diff --git a/media/mtp/MtpStringBuffer.cpp b/media/mtp/MtpStringBuffer.cpp
index fe8cf04..f3420a4 100644
--- a/media/mtp/MtpStringBuffer.cpp
+++ b/media/mtp/MtpStringBuffer.cpp
@@ -56,42 +56,47 @@ MtpStringBuffer::~MtpStringBuffer() {
 }
 
 void MtpStringBuffer::set(const char* src) {
-    int length = strlen(src);
-    if (length >= sizeof(mBuffer))
-        length = sizeof(mBuffer) - 1;
-    memcpy(mBuffer, src, length);
-
     // count the characters
     int count = 0;
     char ch;
-    while ((ch = *src++) != 0) {
+    char* dest = (char*)mBuffer;
+
+    while ((ch = *src++) != 0 && count < MTP_STRING_MAX_CHARACTER_NUMBER) {
         if ((ch & 0x80) == 0) {
             // single byte character
+            *dest++ = ch;
         } else if ((ch & 0xE0) == 0xC0) {
             // two byte character
-            if (! *src++) {
+            char ch1 = *src++;
+            if (! ch1) {
                 // last character was truncated, so ignore last byte
-                length--;
                 break;
             }
+
+            *dest++ = ch;
+            *dest++ = ch1;
         } else if ((ch & 0xF0) == 0xE0) {
             // 3 byte char
-            if (! *src++) {
+            char ch1 = *src++;
+            if (! ch1) {
                 // last character was truncated, so ignore last byte
-                length--;
                 break;
             }
-            if (! *src++) {
-                // last character was truncated, so ignore last two bytes
-                length -= 2;
+            char ch2 = *src++;
+            if (! ch2) {
+                // last character was truncated, so ignore last byte
                 break;
             }
+
+            *dest++ = ch;
+            *dest++ = ch1;
+            *dest++ = ch2;
         }
         count++;
     }
 
-    mByteCount = length + 1;
-    mBuffer[length] = 0;
+    *dest++ = 0;
+    mByteCount = dest - (char*)mBuffer;
     mCharCount = count;
 }
 
@@ -100,7 +105,7 @@ void MtpStringBuffer::set(const uint16_t* src) {
     uint16_t ch;
     uint8_t* dest = mBuffer;
 
-    while ((ch = *src++) != 0 && count < 255) {
+    while ((ch = *src++) != 0 && count < MTP_STRING_MAX_CHARACTER_NUMBER) {
         if (ch >= 0x0800) {
             *dest++ = (uint8_t)(0xE0 | (ch >> 12));
             *dest++ = (uint8_t)(0x80 | ((ch >> 6) & 0x3F));