[PULL 0/1] Trivial patches for 2024-12-31

[PULL 0/1] Trivial patches for 2024-12-31

[Michael Tokarev]

The following changes since commit 7c89e226f878539b633dde3fd9c9f061c34094e3:

  Merge tag 'pull-request-2024-12-29' of https://gitlab.com/huth/qemu into staging (2024-12-29 03:25:41 -0500)

are available in the Git repository at:

  https://gitlab.com/mjt0k/qemu.git tags/pull-trivial-patches

for you to fetch changes up to d8d17d2bf6181cdc9b8ef3db862006ddb6af12d4:

  Revert "vvfat: fix ubsan issue in create_long_filename" (2024-12-31 18:20:41 +0300)

----------------------------------------------------------------
This is just a revert of a previous commit which were pulled
through trivial-patches before but which is obviously wrong.
It is a bugfix to restore the broken vvfat functionality.
Fixing of the ubsan test should be done differently.

I'm sorry for this mishap.
----------------------------------------------------------------
Michael Tokarev (1):
      Revert "vvfat: fix ubsan issue in create_long_filename"

 block/vvfat.c | 4 ----
 1 file changed, 4 deletions(-)

[PULL 1/1] Revert "vvfat: fix ubsan issue in create_long_filename"

[Michael Tokarev]

This reverts commit 0cb3ff7c22671aa1e1e227318799ccf6762c3bea.

The original code was right in that long name in LFN directory
entry uses other parts of the entry for the name too, not just
the original "name" field.  So it is wrong to limit the offset
to be within the name field.  Some other mechanism is needed
to fix the ubsan report and whole messy usage of bytes past the
given field.

Reported-by: Volker Rümelin <vr_qemu@t-online.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 block/vvfat.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/block/vvfat.c b/block/vvfat.c
index f2eafaa923..8ffe8b3b9b 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -426,10 +426,6 @@ static direntry_t *create_long_filename(BDRVVVFATState *s, const char *filename)
         else if(offset<22) offset=14+offset-10;
         else offset=28+offset-22;
         entry=array_get(&(s->directory),s->directory.next-1-(i/26));
-        /* ensure we don't write anything past entry->name */
-        if (offset >= sizeof(entry->name)) {
-            continue;
-        }
         if (i >= 2 * length + 2) {
             entry->name[offset] = 0xff;
         } else if (i % 2 == 0) {
-- 
2.39.5

Re: [PULL 0/1] Trivial patches for 2024-12-31

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 116 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/10.0 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]