lkml.org 
[lkml]   [2009]   [Feb]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: Copying file with bad utf byte sequence in filename to rw UDF filesystem panics
On Fri 30-01-09 00:48:55, Andrew Basterfield wrote:
> Binary package hint: linux-image-2.6.24-22-generic
>
> I have a file on ext3 that has a spurious 0x8A char in it's filename.
> When I try to copy it to a R/W UDF volume I get a kernel panic.
>
> $ ls Air\ -\ Le\ Soleil\ Est\ Pr�s\ De\ Moi.mp3 | hexdump -C
> 00000000 41 69 72 20 2d 20 4c 65 20 53 6f 6c 65 69 6c 20 |Air - Le Soleil |
> 00000010 45 73 74 20 50 72 8a 73 20 44 65 20 4d 6f 69 2e |Est Pr.s De Moi.|
> 00000020 6d 70 33 0a |mp3.|
> 00000024
>
> The filesystem has to be mounted with iocharset=utf8
>
> Is this related to http://lkml.org/lkml/2008/1/30/483
OK, attached patch should fix your problem.

Honza
--
Jan Kara <jack@suse.cz>
SUSE Labs, CR
From a006760466b41fda23d10b9de53b9ad7e2d6120b Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Wed, 4 Feb 2009 19:46:11 +0100
Subject: [PATCH] udf: Fix oops when invalid character in filename occurs

Functions udf_CS0toNLS() and udf_NLStoCS0() didn't count with the fact that
NLS can return negative length when invalid character is given to it for
conversion. Thus interesting things could happen (such as overwriting random
memory with the rest of filename). Add appropriate checks.

Signed-off-by: Jan Kara <jack@suse.cz>
---
fs/udf/unicode.c | 21 ++++++++++++++++-----
1 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
index a3bbdbd..cefa8c8 100644
--- a/fs/udf/unicode.c
+++ b/fs/udf/unicode.c
@@ -254,7 +254,7 @@ static int udf_CS0toNLS(struct nls_table *nls, struct ustr *utf_o,
{
const uint8_t *ocu;
uint8_t cmp_id, ocu_len;
- int i;
+ int i, len;


ocu_len = ocu_i->u_len;
@@ -279,8 +279,13 @@ static int udf_CS0toNLS(struct nls_table *nls, struct ustr *utf_o,
if (cmp_id == 16)
c = (c << 8) | ocu[i++];

- utf_o->u_len += nls->uni2char(c, &utf_o->u_name[utf_o->u_len],
- UDF_NAME_LEN - utf_o->u_len);
+ len = nls->uni2char(c, &utf_o->u_name[utf_o->u_len],
+ UDF_NAME_LEN - utf_o->u_len);
+ /* Valid character? */
+ if (len >= 0)
+ utf_o->u_len += len;
+ else
+ utf_o->u_name[utf_o->u_len++] = '?';
}
utf_o->u_cmpID = 8;

@@ -290,7 +295,8 @@ static int udf_CS0toNLS(struct nls_table *nls, struct ustr *utf_o,
static int udf_NLStoCS0(struct nls_table *nls, dstring *ocu, struct ustr *uni,
int length)
{
- unsigned len, i, max_val;
+ int len;
+ unsigned i, max_val;
uint16_t uni_char;
int u_len;

@@ -302,8 +308,13 @@ try_again:
u_len = 0U;
for (i = 0U; i < uni->u_len; i++) {
len = nls->char2uni(&uni->u_name[i], uni->u_len - i, &uni_char);
- if (len <= 0)
+ if (!len)
continue;
+ /* Invalid character, deal with it */
+ if (len < 0) {
+ len = 1;
+ uni_char = '?';
+ }

if (uni_char > max_val) {
max_val = 0xffffU;
--
1.6.0.2
\
 
 \ /
  Last update: 2009-02-04 20:11    [W:0.040 / U:1.160 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site