github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

fs/ntfs3: Fix OOB write if ret == buf_len in ntfs_utf16_to_nls()

Browse Source 
'utf16s_to_utf8s()' is documented to return at most 'buf_len', the caller
does not check whether 'ret == buf_len' before writing the terminator.
The 'buf[ret] = '\0'' could write a NULL terminator one byte past the
buffer.

Fix this up by limiting ret to the last valid buffer index before writing
NULL.

As long as 'utf16s_to_utf8s()' never return a negative value and
'buf_len' is guaranteed to be nonzero the patch is fine.

Anyway, as defensive fixes, if(ret<0) and if(buf_len==0) could be added.

Signed-off-by: Alexandro Calo <alexandro.calo@nozominetworks.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
This commit is contained in:
Alexandro Calo 2026-07-07 16:23:48 +02:00 committed by Konstantin Komarov
parent 5b76487f94
commit eff11b5a1e
No known key found for this signature in database
GPG Key ID: A9B0331F832407B6
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fs/ntfs3/dir.c
View File

@ -34,6 +34,9 @@ int ntfs_utf16_to_nls(struct ntfs_sb_info *sbi, const __le16 *name, u32 len,
/* UTF-16 -> UTF-8 */
ret = utf16s_to_utf8s((wchar_t *)name, len, UTF16_LITTLE_ENDIAN,
buf, buf_len);
if (ret >= buf_len) {
ret = buf_len-1;
}
buf[ret] = '\0';
return ret;
}