linux-kernel - re: fs/ntfs3: Add option "nocase"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <5799ca65-df15-274b-3319-984f5e1f0fd3@gmail.com>
Date:   Tue, 4 Oct 2022 22:22:34 +0100
From:   "Colin King (gmail)" <colin.i.king@...il.com>
To:     Konstantin Komarov <almaz.alexandrovich@...agon-software.com>
Cc:     ntfs3@...ts.linux.dev,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: re: fs/ntfs3: Add option "nocase"

Hi,

Static analysis with clang scan build has detected an issue in the 
following commit:

commit a3a956c78efaa202b1d75190136671cf6e87bfbe
Author: Konstantin Komarov <almaz.alexandrovich@...agon-software.com>
Date:   Fri Sep 23 12:42:18 2022 +0300

     fs/ntfs3: Add option "nocase"


The issue is as follows in fs/ntfs3/index.c in function ntfs_d_compare:

         /* First try fast implementation. */
         for (;;) {
                 if (!lm--) {
                         ret = len1 == len2 ? 0 : 1;
                         goto out;
                 }

                 if ((c1 = *n1++) == (c2 = *n2++))
                         continue;

                 if (c1 >= 0x80 || c2 >= 0x80)
                         break;

                 if (toupper(c1) != toupper(c2)) {
                         ret = 1;
                         goto out;
                 }
         }

...
...

out:
         __putname(uni1);
         return ret;
}

The exits in the for-loop via label out are ending up with __putname() 
being called on an uninitialized uni1 pointer.

Colin