[PATCH 2/3] nls: utf8_wcstombs: fix buffer overflow

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



utf8_wcstombs forgot to include one-byte UTF-8 characters when
calculating the output buffer size, i.e., theoretically, it was possible
to overflow the output buffer with an input string that contains enough
ASCII characters.

In practice, this was no problem because the only user so far (VFAT)
always uses a big enough output buffer.

Signed-off-by: Clemens Ladisch <clemens@xxxxxxxxxx>

--- linux-2.6.orig/fs/nls/nls_base.c
+++ linux-2.6/fs/nls/nls_base.c
@@ -150,6 +150,7 @@ utf8_wcstombs(__u8 *s, const wchar_t *pw
 			}
 		} else {
 			*op++ = (__u8) *ip;
+			maxlen--;
 		}
 		ip++;
 	}
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux