fs: fix FAT name extraction
authorPatrick Wildt <patrick@blueri.se>
Mon, 26 Nov 2018 14:58:13 +0000 (15:58 +0100)
committerTom Rini <trini@konsulko.com>
Fri, 7 Dec 2018 04:26:31 +0000 (23:26 -0500)
The long name apparently can be accumulated using multiple
13-byte slots.  Unfortunately we never checked how many we
can actually fit in the buffer we are reading to.

Signed-off-by: Patrick Wildt <patrick@blueri.se>
fs/fat/fat.c

index e0c076763f57add116f93ef173317c27cda44fca..ac8913e71929b1a847d09fdc1d69552f72afc962 100644 (file)
@@ -821,6 +821,9 @@ static dir_entry *extract_vfat_name(fat_itr *itr)
 
                slot2str((dir_slot *)dent, buf, &idx);
 
+               if (n + idx >= sizeof(itr->l_name))
+                       return NULL;
+
                /* shift accumulated long-name up and copy new part in: */
                memmove(itr->l_name + idx, itr->l_name, n);
                memcpy(itr->l_name, buf, idx);