diff options
| author | Patrick Wildt <patrick@blueri.se> | 2018-11-26 15:58:13 +0100 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2018-12-06 23:26:31 -0500 |
| commit | 8b021bb956c3c890255d611f3780d3be7638a63a (patch) | |
| tree | 50f380576eabd45be9304c61fe2e6fe0bcb7d9f0 /fs | |
| parent | cd80a4fe611d7cb4153a6ed39d1e5052c702fb12 (diff) | |
| download | u-boot-8b021bb956c3c890255d611f3780d3be7638a63a.tar.gz u-boot-8b021bb956c3c890255d611f3780d3be7638a63a.tar.bz2 u-boot-8b021bb956c3c890255d611f3780d3be7638a63a.zip | |
fs: fix FAT name extraction
The long name apparently can be accumulated using multiple
13-byte slots. Unfortunately we never checked how many we
can actually fit in the buffer we are reading to.
Signed-off-by: Patrick Wildt <patrick@blueri.se>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/fat/fat.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/fat/fat.c b/fs/fat/fat.c index e0c076763f..ac8913e719 100644 --- a/fs/fat/fat.c +++ b/fs/fat/fat.c @@ -821,6 +821,9 @@ static dir_entry *extract_vfat_name(fat_itr *itr) slot2str((dir_slot *)dent, buf, &idx); + if (n + idx >= sizeof(itr->l_name)) + return NULL; + /* shift accumulated long-name up and copy new part in: */ memmove(itr->l_name + idx, itr->l_name, n); memcpy(itr->l_name, buf, idx); |