Copying file with bad utf byte sequence in filename to rw UDF filesystem panics

Copying file with bad utf byte sequence in filename to rw UDF filesystem panics

[Andrew Basterfield]

Binary package hint: linux-image-2.6.24-22-generic

I have a file on ext3 that has a spurious 0x8A char in it's filename.
When I try to copy it to a R/W UDF volume I get a kernel panic.

$ ls Air\ -\ Le\ Soleil\ Est\ Pr�s\ De\ Moi.mp3 | hexdump -C
00000000  41 69 72 20 2d 20 4c 65  20 53 6f 6c 65 69 6c 20  |Air - Le Soleil |
00000010  45 73 74 20 50 72 8a 73  20 44 65 20 4d 6f 69 2e  |Est Pr.s De Moi.|
00000020  6d 70 33 0a                                       |mp3.|
00000024

The filesystem has to be mounted with iocharset=utf8

Is this related to http://lkml.org/lkml/2008/1/30/483

thanks

Andrew Basterfield

Re: Copying file with bad utf byte sequence in filename to rw UDF filesystem panics

[Jan Kara]

[-- Attachment #1: Type: text/plain, Size: 773 bytes --]

On Fri 30-01-09 00:48:55, Andrew Basterfield wrote:
> Binary package hint: linux-image-2.6.24-22-generic
>
> I have a file on ext3 that has a spurious 0x8A char in it's filename.
> When I try to copy it to a R/W UDF volume I get a kernel panic.
>
> $ ls Air\ -\ Le\ Soleil\ Est\ Pr�s\ De\ Moi.mp3 | hexdump -C
> 00000000  41 69 72 20 2d 20 4c 65  20 53 6f 6c 65 69 6c 20  |Air - Le Soleil |
> 00000010  45 73 74 20 50 72 8a 73  20 44 65 20 4d 6f 69 2e  |Est Pr.s De Moi.|
> 00000020  6d 70 33 0a                                       |mp3.|
> 00000024
>
> The filesystem has to be mounted with iocharset=utf8
>
> Is this related to http://lkml.org/lkml/2008/1/30/483
  OK, attached patch should fix your problem.

									Honza
-- 
Jan Kara <jack@suse.cz>
SUSE Labs, CR

[-- Attachment #2: 0001-udf-Fix-oops-when-invalid-character-in-filename-occ.patch --]
[-- Type: text/x-patch, Size: 2090 bytes --]

>From a006760466b41fda23d10b9de53b9ad7e2d6120b Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Wed, 4 Feb 2009 19:46:11 +0100
Subject: [PATCH] udf: Fix oops when invalid character in filename occurs

Functions udf_CS0toNLS() and udf_NLStoCS0() didn't count with the fact that
NLS can return negative length when invalid character is given to it for
conversion. Thus interesting things could happen (such as overwriting random
memory with the rest of filename). Add appropriate checks.

Signed-off-by: Jan Kara <jack@suse.cz>
---
 fs/udf/unicode.c |   21 ++++++++++++++++-----
 1 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
index a3bbdbd..cefa8c8 100644
--- a/fs/udf/unicode.c
+++ b/fs/udf/unicode.c
@@ -254,7 +254,7 @@ static int udf_CS0toNLS(struct nls_table *nls, struct ustr *utf_o,
 {
 	const uint8_t *ocu;
 	uint8_t cmp_id, ocu_len;
-	int i;
+	int i, len;
 
 
 	ocu_len = ocu_i->u_len;
@@ -279,8 +279,13 @@ static int udf_CS0toNLS(struct nls_table *nls, struct ustr *utf_o,
 		if (cmp_id == 16)
 			c = (c << 8) | ocu[i++];
 
-		utf_o->u_len += nls->uni2char(c, &utf_o->u_name[utf_o->u_len],
-					      UDF_NAME_LEN - utf_o->u_len);
+		len = nls->uni2char(c, &utf_o->u_name[utf_o->u_len],
+				    UDF_NAME_LEN - utf_o->u_len);
+		/* Valid character? */
+		if (len >= 0)
+			utf_o->u_len += len;
+		else
+			utf_o->u_name[utf_o->u_len++] = '?';
 	}
 	utf_o->u_cmpID = 8;
 
@@ -290,7 +295,8 @@ static int udf_CS0toNLS(struct nls_table *nls, struct ustr *utf_o,
 static int udf_NLStoCS0(struct nls_table *nls, dstring *ocu, struct ustr *uni,
 			int length)
 {
-	unsigned len, i, max_val;
+	int len;
+	unsigned i, max_val;
 	uint16_t uni_char;
 	int u_len;
 
@@ -302,8 +308,13 @@ try_again:
 	u_len = 0U;
 	for (i = 0U; i < uni->u_len; i++) {
 		len = nls->char2uni(&uni->u_name[i], uni->u_len - i, &uni_char);
-		if (len <= 0)
+		if (!len)
 			continue;
+		/* Invalid character, deal with it */
+		if (len < 0) {
+			len = 1;
+			uni_char = '?';
+		}
 
 		if (uni_char > max_val) {
 			max_val = 0xffffU;
-- 
1.6.0.2