Messages in this thread | | | From | OGAWA Hirofumi <> | Subject | Re: [PATCH] fat: Read buffer overflow | Date | Sat, 08 Aug 2009 08:06:22 +0900 |
| |
Roel Kluin <roel.kluin@gmail.com> writes:
> If len is less or equal to 0, this results in a read of s[-1]. > > Signed-off-by: Roel Kluin <roel.kluin@gmail.com> > --- > diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c > index 6f27853..114ff6d 100644 > --- a/fs/fat/namei_vfat.c > +++ b/fs/fat/namei_vfat.c > @@ -202,6 +202,9 @@ static inline int vfat_is_used_badchars(const wchar_t *s, int len) > { > int i; > > + if (len <= 0) > + return -EINVAL; > + > for (i = 0; i < len; i++) > if (vfat_bad_char(s[i])) > return -EINVAL;
Um..., what case is this possible? vfat_add_entry() checks (len == 0). And if xlate_to_uni() couldn't convert name, it should return the error.
Thanks. -- OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
| |