diff options
author | Nikolaus Schulz <[email protected]> | 2010-04-01 02:21:10 +0900 |
---|---|---|
committer | Linus Torvalds <[email protected]> | 2010-03-31 10:34:11 -0700 |
commit | 30d1872d9eb3663b4cf7bdebcbf5cd465674cced (patch) | |
tree | e3771c93ad38ad5e8f9d8c70a0915afb81423545 /net/lapb/lapb_in.c | |
parent | 2eaa9cfdf33b8d7fb7aff27792192e0019ae8fc6 (diff) |
fat: fix buffer overflow in vfat_create_shortname()
When using the string representation of a random counter as part of the base
name, ensure that it is no longer than 4 bytes.
Since we are repeatedly decrementing the counter in a loop until we have found a
unique base name, the counter may wrap around zero; therefore, it is not enough
to mask its higher bits before entering the loop, this must be done inside the
loop.
[[email protected]: use snprintf()]
Signed-off-by: Nikolaus Schulz <[email protected]>
Cc: [email protected]
Signed-off-by: OGAWA Hirofumi <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Diffstat (limited to 'net/lapb/lapb_in.c')
0 files changed, 0 insertions, 0 deletions