tree e3771c93ad38ad5e8f9d8c70a0915afb81423545
parent 2eaa9cfdf33b8d7fb7aff27792192e0019ae8fc6
author Nikolaus Schulz <microschulz@web.de> 1270056070 +0900
committer Linus Torvalds <torvalds@linux-foundation.org> 1270056851 -0700

fat: fix buffer overflow in vfat_create_shortname()

When using the string representation of a random counter as part of the base
name, ensure that it is no longer than 4 bytes.

Since we are repeatedly decrementing the counter in a loop until we have found a
unique base name, the counter may wrap around zero; therefore, it is not enough
to mask its higher bits before entering the loop, this must be done inside the
loop.

[hirofumi@mail.parknet.co.jp: use snprintf()]
Signed-off-by: Nikolaus Schulz <microschulz@web.de>
Cc: stable@kernel.org
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>