Messages in this thread Patch in this message | | | Date | Wed, 4 Feb 2009 19:57:58 +0100 | From | Jan Kara <> | Subject | Re: Copying file with bad utf byte sequence in filename to rw UDF filesystem panics |
| |
On Fri 30-01-09 00:48:55, Andrew Basterfield wrote: > Binary package hint: linux-image-2.6.24-22-generic > > I have a file on ext3 that has a spurious 0x8A char in it's filename. > When I try to copy it to a R/W UDF volume I get a kernel panic. > > $ ls Air\ -\ Le\ Soleil\ Est\ Pr�s\ De\ Moi.mp3 | hexdump -C > 00000000 41 69 72 20 2d 20 4c 65 20 53 6f 6c 65 69 6c 20 |Air - Le Soleil | > 00000010 45 73 74 20 50 72 8a 73 20 44 65 20 4d 6f 69 2e |Est Pr.s De Moi.| > 00000020 6d 70 33 0a |mp3.| > 00000024 > > The filesystem has to be mounted with iocharset=utf8 > > Is this related to http://lkml.org/lkml/2008/1/30/483 OK, attached patch should fix your problem.
Honza -- Jan Kara <jack@suse.cz> SUSE Labs, CR From a006760466b41fda23d10b9de53b9ad7e2d6120b Mon Sep 17 00:00:00 2001 From: Jan Kara <jack@suse.cz> Date: Wed, 4 Feb 2009 19:46:11 +0100 Subject: [PATCH] udf: Fix oops when invalid character in filename occurs
Functions udf_CS0toNLS() and udf_NLStoCS0() didn't count with the fact that NLS can return negative length when invalid character is given to it for conversion. Thus interesting things could happen (such as overwriting random memory with the rest of filename). Add appropriate checks.
Signed-off-by: Jan Kara <jack@suse.cz> --- fs/udf/unicode.c | 21 ++++++++++++++++----- 1 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c index a3bbdbd..cefa8c8 100644 --- a/fs/udf/unicode.c +++ b/fs/udf/unicode.c @@ -254,7 +254,7 @@ static int udf_CS0toNLS(struct nls_table *nls, struct ustr *utf_o, { const uint8_t *ocu; uint8_t cmp_id, ocu_len; - int i; + int i, len; ocu_len = ocu_i->u_len; @@ -279,8 +279,13 @@ static int udf_CS0toNLS(struct nls_table *nls, struct ustr *utf_o, if (cmp_id == 16) c = (c << 8) | ocu[i++]; - utf_o->u_len += nls->uni2char(c, &utf_o->u_name[utf_o->u_len], - UDF_NAME_LEN - utf_o->u_len); + len = nls->uni2char(c, &utf_o->u_name[utf_o->u_len], + UDF_NAME_LEN - utf_o->u_len); + /* Valid character? */ + if (len >= 0) + utf_o->u_len += len; + else + utf_o->u_name[utf_o->u_len++] = '?'; } utf_o->u_cmpID = 8; @@ -290,7 +295,8 @@ static int udf_CS0toNLS(struct nls_table *nls, struct ustr *utf_o, static int udf_NLStoCS0(struct nls_table *nls, dstring *ocu, struct ustr *uni, int length) { - unsigned len, i, max_val; + int len; + unsigned i, max_val; uint16_t uni_char; int u_len; @@ -302,8 +308,13 @@ try_again: u_len = 0U; for (i = 0U; i < uni->u_len; i++) { len = nls->char2uni(&uni->u_name[i], uni->u_len - i, &uni_char); - if (len <= 0) + if (!len) continue; + /* Invalid character, deal with it */ + if (len < 0) { + len = 1; + uni_char = '?'; + } if (uni_char > max_val) { max_val = 0xffffU; -- 1.6.0.2
| |