[PATCH] fs/ntfs3: Fix OOB write if ret == buf_len in ntfs_utf16_to_nls()

From 711162530c2cdc4f4930b5a08db0093e6618a26d Mon Sep 17 00:00:00 2001
From: Alexandro Calo <[email protected]>
Date: Tue, 7 Jul 2026 16:23:48 +0200
Subject: [PATCH] fs/ntfs3: Fix OOB write if ret =3D=3D buf_len in ntfs_utf1=
6_to_nls()

'utf16s_to_utf8s()' is documented to return at most 'buf_len', the caller
does not check whether 'ret =3D=3D buf_len' before writing the terminator.
The 'buf[ret] =3D '\0'' could write a NULL terminator one byte past the
buffer.

Fix this up by limiting ret to the last valid buffer index before writing
NULL.

As long as 'utf16s_to_utf8s()' never return a negative value and
'buf_len' is guaranteed to be nonzero the patch is fine.

Anyway, as defensive fixes, if(ret<0) and if(buf_len=3D=3D0) could be added=
.

Signed-off-by: Alexandro Calo <[email protected]>
---
 fs/ntfs3/dir.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c
index 873d52233003..93949b8352d8 100644
--- a/fs/ntfs3/dir.c
+++ b/fs/ntfs3/dir.c
@@ -29,6 +29,9 @@ int ntfs_utf16_to_nls(struct ntfs_sb_info *sbi, const __l=
e16 *name, u32 len,
 		/* UTF-16 -> UTF-8 */
 		ret =3D utf16s_to_utf8s((wchar_t *)name, len, UTF16_LITTLE_ENDIAN,
 				      buf, buf_len);
+        if (ret >=3D buf_len) {
+            ret =3D buf_len-1;
+        }
 		buf[ret] =3D '\0';
 		return ret;
 	}
base-commit: 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53
--
2.47.3=