diff options
| author | Kyle Zeng <kylebot@openai.com> | 2026-06-11 14:33:31 -0700 |
|---|---|---|
| committer | Konstantin Komarov <almaz.alexandrovich@paragon-software.com> | 2026-07-24 12:45:03 +0200 |
| commit | 4871fedaabbfd574ac0a075b80e75afdd532e11e (patch) | |
| tree | 11401b14b68c79fb74715961020d77272647e170 | |
| parent | dd64afb32c4d8d3c934ae84df59a2e463d6fa43c (diff) | |
| download | linux-next-4871fedaabbfd574ac0a075b80e75afdd532e11e.tar.gz linux-next-4871fedaabbfd574ac0a075b80e75afdd532e11e.zip | |
fs/ntfs3: reserve NUL byte when converting UTF-16 names
ntfs_utf16_to_nls() appends a trailing NUL to the converted output,
but it passes the caller-supplied size directly to the conversion loop.
For the UTF-8 path, utf16s_to_utf8s() can legitimately fill all
buf_len bytes and return buf_len, after which ntfs_utf16_to_nls()
writes the terminator one byte past the end of the destination buffer.
The same contract problem exists for the NLS path when a converted
character consumes the last available byte.
Reserve one byte for the terminator before doing either conversion.
The function continues to return the number of converted bytes,
excluding the NUL terminator.
Assisted-by: Codex:gpt-5.5
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
| -rw-r--r-- | fs/ntfs3/dir.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c index 62482c2352ad..6f8ad8428f49 100644 --- a/fs/ntfs3/dir.c +++ b/fs/ntfs3/dir.c @@ -25,6 +25,11 @@ int ntfs_utf16_to_nls(struct ntfs_sb_info *sbi, const __le16 *name, u32 len, static_assert(sizeof(wchar_t) == sizeof(__le16)); + if (buf_len <= 0) + return -EINVAL; + + buf_len -= 1; + if (!nls) { /* UTF-16 -> UTF-8 */ ret = utf16s_to_utf8s((wchar_t *)name, len, UTF16_LITTLE_ENDIAN, |