Messages in this thread | | | Subject | Re: [PATCH] fat: Read buffer overflow | From | Pekka Enberg <> | Date | Sat, 08 Aug 2009 13:12:32 +0300 |
| |
On Sat, 2009-08-08 at 19:10 +0900, OGAWA Hirofumi wrote: > Pekka Enberg <penberg@cs.helsinki.fi> writes: > > > Yes, but we pass "ulen" to vfat_is_used_badchars(). The value of > > "ulen" is a returned in the "longlen" argument of xlate_to_uni() which > > in turn is calculated as follows for the UTF-8 case: > > > > int name_len = strlen(name); > > *outlen = utf8s_to_utf16s(name, PATH_MAX, (wchar_t *) outname); > > *outlen -= (name_len - len); > > *longlen = *outlen; > > > > Maybe "*outlen" can never be negative because of some invariants that > > I don't see but it's so non-obvious to me that I'd like to see the > > explicit check in vfat_is_used_badchars(). > > Ah, good point. Sorry, I was looking my tree. I'm going to submit the > attached patch on next merge window. > > Is this enough for it?
Fine by me!
Pekka
| |