mirror of
https://github.com/torvalds/linux.git
synced 2024-11-27 14:41:39 +00:00
6305a0a9d5
udf_build_ustr was broken:
- size == 1:
dest->u_len = ptr[1 - 1], but at ptr[0] there's cmpID,
so we created string with wrong length
it should not happen, so we BUG() it
- size > 1 and size < UDF_NAME_LEN:
we set u_len correctly, but memcpy copied one needless byte
- size == UDF_NAME_LEN - 1:
memcpy overwrited u_len - with correct value, but...
- size >= UDF_NAME_LEN:
we copied UDF_NAME_LEN - 1 bytes, but dest->u_name is array
of UDF_NAME_LEN - 2 bytes, so we were overwriting u_len with
character from input string
nobody noticed because all callers set size
to acceptable values (constants within range)
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
|
||
|---|---|---|
| .. | ||
| balloc.c | ||
| crc.c | ||
| dir.c | ||
| directory.c | ||
| ecma_167.h | ||
| file.c | ||
| fsync.c | ||
| ialloc.c | ||
| inode.c | ||
| lowlevel.c | ||
| Makefile | ||
| misc.c | ||
| namei.c | ||
| osta_udf.h | ||
| partition.c | ||
| super.c | ||
| symlink.c | ||
| truncate.c | ||
| udf_i.h | ||
| udf_sb.h | ||
| udfdecl.h | ||
| udfend.h | ||
| udftime.c | ||
| unicode.c | ||