lkml.org 
[lkml]   [2010]   [Apr]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[004/197] fat: fix buffer overflow in vfat_create_shortname()
    2.6.32-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Nikolaus Schulz <microschulz@web.de>

    commit 30d1872d9eb3663b4cf7bdebcbf5cd465674cced upstream.

    When using the string representation of a random counter as part of the base
    name, ensure that it is no longer than 4 bytes.

    Since we are repeatedly decrementing the counter in a loop until we have found a
    unique base name, the counter may wrap around zero; therefore, it is not enough
    to mask its higher bits before entering the loop, this must be done inside the
    loop.

    [hirofumi@mail.parknet.co.jp: use snprintf()]
    Signed-off-by: Nikolaus Schulz <microschulz@web.de>
    Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    fs/fat/namei_vfat.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    --- a/fs/fat/namei_vfat.c
    +++ b/fs/fat/namei_vfat.c
    @@ -309,7 +309,7 @@ static int vfat_create_shortname(struct
    {
    struct fat_mount_options *opts = &MSDOS_SB(dir->i_sb)->options;
    wchar_t *ip, *ext_start, *end, *name_start;
    - unsigned char base[9], ext[4], buf[8], *p;
    + unsigned char base[9], ext[4], buf[5], *p;
    unsigned char charbuf[NLS_MAX_CHARSET_SIZE];
    int chl, chi;
    int sz = 0, extlen, baselen, i, numtail_baselen, numtail2_baselen;
    @@ -467,7 +467,7 @@ static int vfat_create_shortname(struct
    return 0;
    }

    - i = jiffies & 0xffff;
    + i = jiffies;
    sz = (jiffies >> 16) & 0x7;
    if (baselen > 2) {
    baselen = numtail2_baselen;
    @@ -476,7 +476,7 @@ static int vfat_create_shortname(struct
    name_res[baselen + 4] = '~';
    name_res[baselen + 5] = '1' + sz;
    while (1) {
    - sprintf(buf, "%04X", i);
    + snprintf(buf, sizeof(buf), "%04X", i & 0xffff);
    memcpy(&name_res[baselen], buf, 4);
    if (vfat_find_form(dir, name_res) < 0)
    break;



    \
     
     \ /
      Last update: 2010-04-22 22:53    [W:5.496 / U:0.136 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site