ntfs-3g/libntfs-3g
Erik Larsson 75dcdc2cf3 unistr.c: Fix use-after-free in 'ntfs_uppercase_mbs'.
If 'utf8_to_unicode' throws an error due to an invalid UTF-8 sequence,
then 'n' will be less than 0 and the loop will terminate without storing
anything in '*t'. After the loop the uppercase string's allocation is
freed, however after it is freed it is unconditionally accessed through
'*t', which points into the freed allocation, for the purpose of NULL-
terminating the string. This leads to a use-after-free.
Fixed by only NULL-terminating the string when no error has been thrown.

Thanks for Jeffrey Bencteux for reporting this issue:
https://github.com/tuxera/ntfs-3g/issues/84
2023-06-13 17:47:15 +03:00
..
Makefile.am Prevented locally defined headers from interfering with ntfs-3g ones 2018-08-02 16:47:16 +02:00
acls.c Fixed initialization of a Posix ACL 2021-05-17 15:37:45 +03:00
attrib.c attrib.c: Fix another instance of errno not being set on error. 2023-05-19 12:20:54 +03:00
attrlist.c Fix incorrect usage of native/little-endian types, signed types, etc. 2015-12-21 23:55:31 +01:00
bitmap.c Adapted to ntfs-3g.1.2712 2008-07-13 17:55:57 +00:00
bootsect.c Hardened the check of locations of MFT and MFTMirr 2021-07-12 08:31:18 +02:00
cache.c Removed unneeded variables as warned by gcc 4.6 2011-07-05 12:17:29 +02:00
collate.c Made direct calls to collation functions 2009-12-16 10:20:57 +00:00
compat.c Adapted to ntfs-3g.1.2812 2008-08-16 15:17:47 +00:00
compress.c Made sure the requested compression block size is supported 2021-07-19 09:23:23 +02:00
debug.c Adapted to ntfs-3g.2009.3.8 2009-03-27 09:10:00 +00:00
device.c Fixed a use of uninitialized variable compiler warning 2013-02-13 08:54:34 +01:00
dir.c Renamed ntfs_index_entry_consistent() as ntfs_index_entry_inconsistent() 2021-07-19 09:23:23 +02:00
ea.c Enabled Recording the special files the same way as WSL 2021-01-26 10:06:18 +01:00
efs.c Allowed using full library API on systems without extended attributes support 2016-07-28 16:13:59 +02:00
index.c index.c: Fix crash when a reparse tag cannot be found in the index. 2023-05-03 10:44:57 +02:00
inode.c Rejected negative data length in an attribute list 2021-07-19 09:23:23 +02:00
ioctl.c Fixed defining the request argument of ioctl() 2020-03-08 10:34:17 +01:00
lcnalloc.c Skipped errors for bad free clusters before they are computed 2021-07-19 09:23:23 +02:00
libntfs-3g.pc.in Updating the source directory tree 2008-03-28 14:42:50 +00:00
libntfs-3g.script.so.in Updating the source directory tree 2008-03-28 14:42:50 +00:00
logfile.c Made sure the client log data does not overflow from restart page 2021-10-20 09:53:28 +02:00
logging.c Enabled renaming of system extended attributes 2010-10-26 08:59:52 +02:00
mft.c mft.c: Fix broken free MFT records accounting during bitmap extension. 2023-05-09 11:25:10 +03:00
misc.c Defined ntfs_realloc() and ntfs_free() 2021-01-26 10:06:17 +01:00
mst.c Corrected validation of multi sector transfer protected records 2016-07-28 16:26:21 +02:00
object_id.c Cleaned object ids beyond the updated part 2019-01-23 17:27:25 +01:00
realpath.c Silenced warnings about string lengths in snprintf() 2020-03-08 09:29:04 +01:00
reparse.c Enabled Recording the special files the same way as WSL 2021-01-26 10:06:18 +01:00
runlist.c Avoided merging runlists with no runs 2022-09-14 08:31:31 +02:00
security.c Fixed returning EPERM when not allowed as owner 2020-03-07 11:35:48 +01:00
unistr.c unistr.c: Fix use-after-free in 'ntfs_uppercase_mbs'. 2023-06-13 17:47:15 +03:00
unix_io.c Defined the request argument of ioctl() as unsigned long 2020-03-07 10:31:12 +01:00
volume.c Updated the urls present in ntfs-3g code 2021-08-30 09:27:33 +02:00
win32_io.c Defined the request argument of ioctl() as unsigned long 2020-03-07 10:31:12 +01:00
xattrs.c Fixed returning errno in setxattr 2020-03-07 10:51:53 +01:00