diff options
author | Marcin Slusarz <marcin.slusarz@gmail.com> | 2008-02-04 16:27:39 -0500 |
---|---|---|
committer | Jan Kara <jack@suse.cz> | 2008-04-17 08:22:24 -0400 |
commit | 6305a0a9d559e97807b8bc6d5250fd525dc571a7 (patch) | |
tree | 5f644150de3fac27458f347cf9d59d0a52ba3611 /kernel/rcutorture.c | |
parent | 79cfe0ff5fb585b92126365a2881262945ac0ee9 (diff) |
udf: fix udf_build_ustr
udf_build_ustr was broken:
- size == 1:
dest->u_len = ptr[1 - 1], but at ptr[0] there's cmpID,
so we created string with wrong length
it should not happen, so we BUG() it
- size > 1 and size < UDF_NAME_LEN:
we set u_len correctly, but memcpy copied one needless byte
- size == UDF_NAME_LEN - 1:
memcpy overwrited u_len - with correct value, but...
- size >= UDF_NAME_LEN:
we copied UDF_NAME_LEN - 1 bytes, but dest->u_name is array
of UDF_NAME_LEN - 2 bytes, so we were overwriting u_len with
character from input string
nobody noticed because all callers set size
to acceptable values (constants within range)
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Diffstat (limited to 'kernel/rcutorture.c')
0 files changed, 0 insertions, 0 deletions