diff options
| author | Clemens Ladisch <clemens@ladisch.de> | 2009-04-24 10:11:56 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-06-16 06:44:43 +0200 |
| commit | 905c02acbd89f427c87a6d0a50fed757f6b3001c (patch) | |
| tree | a4844dac7cd7bbce34ab33295eaa402d996e9b48 | |
| parent | nls: utf8_wcstombs: use correct buffer size in error case (diff) | |
| download | linux-905c02acbd89f427c87a6d0a50fed757f6b3001c.tar.xz linux-905c02acbd89f427c87a6d0a50fed757f6b3001c.zip | |
nls: utf8_wcstombs: fix buffer overflow
utf8_wcstombs forgot to include one-byte UTF-8 characters when
calculating the output buffer size, i.e., theoretically, it was possible
to overflow the output buffer with an input string that contains enough
ASCII characters.
In practice, this was no problem because the only user so far (VFAT)
always uses a big enough output buffer.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | fs/nls/nls_base.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/nls/nls_base.c b/fs/nls/nls_base.c index 000736d89c95..750abf211e26 100644 --- a/fs/nls/nls_base.c +++ b/fs/nls/nls_base.c @@ -150,6 +150,7 @@ utf8_wcstombs(__u8 *s, const wchar_t *pwcs, int maxlen) } } else { *op++ = (__u8) *ip; + maxlen--; } ip++; } |