From a55329da927a0fc3cd7c219b9ef2df51a3ae964b Mon Sep 17 00:00:00 2001 From: "Darrick J. Wong" Date: Mon, 24 Feb 2025 10:22:08 -0800 Subject: [PATCH] xfs_scrub: fix buffer overflow in string_escape Need to allocate one more byte for the null terminator, just in case the /entire/ input string consists of non-printable bytes e.g. emoji. Cc: # v4.15.0 Fixes: 396cd0223598bb ("xfs_scrub: warn about suspicious characters in directory/xattr names") Signed-off-by: "Darrick J. Wong" Reviewed-by: Andrey Albershteyn Reviewed-by: Christoph Hellwig --- scrub/common.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/scrub/common.c b/scrub/common.c index 6eb3c026..2b2d4a67 100644 --- a/scrub/common.c +++ b/scrub/common.c @@ -320,7 +320,11 @@ string_escape( char *q; int x; - str = malloc(strlen(in) * 4); + /* + * Each non-printing byte renders as a four-byte escape sequence, so + * allocate 4x the input length, plus a byte for the null terminator. + */ + str = malloc(strlen(in) * 4 + 1); if (!str) return NULL; for (p = in, q = str; *p != '\0'; p++) { -- 2.47.2