Skip to content

Commit a6cd43f

Browse files
neosys007aalexandrovich
authored andcommitted
fs/ntfs3: terminate the cached volume label after UTF-8 conversion
ntfs_fill_super() loads the on-disk volume label with utf16s_to_utf8s() and stores the result in sbi->volume.label. The converted label is later exposed through ntfs3_label_show() using %s, but utf16s_to_utf8s() only returns the number of bytes written and does not add a trailing NUL. If the converted label fills the entire fixed buffer, ntfs3_label_show() can read past the end of sbi->volume.label while looking for a terminator. Terminate the cached label explicitly after a successful conversion and clamp the exact-full case to the last byte of the buffer. Fixes: 82cae26 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
1 parent d106268 commit a6cd43f

1 file changed

Lines changed: 6 additions & 1 deletion

File tree

fs/ntfs3/super.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1339,8 +1339,13 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
13391339
le32_to_cpu(attr->res.data_size) >> 1,
13401340
UTF16_LITTLE_ENDIAN, sbi->volume.label,
13411341
sizeof(sbi->volume.label));
1342-
if (err < 0)
1342+
if (err < 0) {
13431343
sbi->volume.label[0] = 0;
1344+
} else if (err >= sizeof(sbi->volume.label)) {
1345+
sbi->volume.label[sizeof(sbi->volume.label) - 1] = 0;
1346+
} else {
1347+
sbi->volume.label[err] = 0;
1348+
}
13441349
} else {
13451350
/* Should we break mounting here? */
13461351
//err = -EINVAL;

0 commit comments

Comments
 (0)