From eff11b5a1eacea8d17fa50ad0b1c2ef405341f2c Mon Sep 17 00:00:00 2001 From: Alexandro Calo Date: Tue, 7 Jul 2026 16:23:48 +0200 Subject: [PATCH] fs/ntfs3: Fix OOB write if ret == buf_len in ntfs_utf16_to_nls() 'utf16s_to_utf8s()' is documented to return at most 'buf_len', the caller does not check whether 'ret == buf_len' before writing the terminator. The 'buf[ret] = '\0'' could write a NULL terminator one byte past the buffer. Fix this up by limiting ret to the last valid buffer index before writing NULL. As long as 'utf16s_to_utf8s()' never return a negative value and 'buf_len' is guaranteed to be nonzero the patch is fine. Anyway, as defensive fixes, if(ret<0) and if(buf_len==0) could be added. Signed-off-by: Alexandro Calo Signed-off-by: Konstantin Komarov --- fs/ntfs3/dir.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c index eb9152e9fa22..328c9a29df89 100644 --- a/fs/ntfs3/dir.c +++ b/fs/ntfs3/dir.c @@ -34,6 +34,9 @@ int ntfs_utf16_to_nls(struct ntfs_sb_info *sbi, const __le16 *name, u32 len, /* UTF-16 -> UTF-8 */ ret = utf16s_to_utf8s((wchar_t *)name, len, UTF16_LITTLE_ENDIAN, buf, buf_len); + if (ret >= buf_len) { + ret = buf_len-1; + } buf[ret] = '\0'; return ret; }