Filelight crashes if readdir returns very long file name

Authored by i.Dark_Templar on Oct 29 2017, 11:51 AM.

Description

Filelight crashes if readdir returns very long file name

Summary:
While it's usually stated that 'struct dirent' has member 'char d_name[PATH_MAX + 1]', it is possible to obtain results when this field contains a string longer than PATH_MAX + 1. Stringbuilder in that case would copy only PATH_MAX + 1 first bytes, and wouldn't add zero terminator to this copied string, which would eventually lead to crash.

How to reproduce:

  1. use ntfs filesystem (for example, via ntfs-3g)

Ntfs filesystem uses maximum number of characters for restricting file name length, not bytes, and character may be longer than 1 byte.

  1. create a file with name out of > 255 bytes, but less than 255 characters. Use non-ascii characters for that and UTF-8 locale.

It's too long filename for a Linux filesystem, but actually a valid name for ntfs filesystem.
In my case, I hit a file with name of 166 characters and 264 bytes (not including zero terminator).

  1. run filelight on filesystem containing that file and see it crash.

What should happen:
Filelight should run fine, and if struct dirent::d_name is longer that PATH_MAX, it should work fine with it.

Reviewers: sitter, kfunk, sandsmark

Reviewed By: sandsmark

Subscribers: sandsmark, kde-utils-devel

Differential Revision: https://phabricator.kde.org/D8413

Details

Committed
aacidOct 29 2017, 11:51 AM
Reviewer
sandsmark
Differential Revision
D8413: Filelight crashes if readdir returns very long file name
Parents
R352:69f296d4d5b8: GIT_SILENT made messages (after extraction)
Branches
Unknown
Tags
Unknown