Revert "vvfat: fix ubsan issue in create_long_filename"
authorMichael Tokarev <mjt@tls.msk.ru>
Sun, 29 Dec 2024 21:08:50 +0000 (00:08 +0300)
committerMichael Tokarev <mjt@tls.msk.ru>
Tue, 31 Dec 2024 15:20:41 +0000 (18:20 +0300)
This reverts commit 0cb3ff7c22671aa1e1e227318799ccf6762c3bea.

The original code was right in that long name in LFN directory
entry uses other parts of the entry for the name too, not just
the original "name" field.  So it is wrong to limit the offset
to be within the name field.  Some other mechanism is needed
to fix the ubsan report and whole messy usage of bytes past the
given field.

Reported-by: Volker RĂ¼melin <vr_qemu@t-online.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
block/vvfat.c

index f2eafaa92348875a8a20c8c6f56a215b7de72921..8ffe8b3b9bfaf26560c6ae006f5c758b54ff849d 100644 (file)
@@ -426,10 +426,6 @@ static direntry_t *create_long_filename(BDRVVVFATState *s, const char *filename)
         else if(offset<22) offset=14+offset-10;
         else offset=28+offset-22;
         entry=array_get(&(s->directory),s->directory.next-1-(i/26));
-        /* ensure we don't write anything past entry->name */
-        if (offset >= sizeof(entry->name)) {
-            continue;
-        }
         if (i >= 2 * length + 2) {
             entry->name[offset] = 0xff;
         } else if (i % 2 == 0) {