Language: C
Label: vulnerable
CWE: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.

Code:
static int handle_dot_dotdot_filename(struct exfat_de_iter *iter,
				      struct exfat_dentry *dentry,
				      int strm_name_len)
{
	char *filename;
	char error_msg[150];
	int num;

	if (!memcmp(dentry->name_unicode, MSDOS_DOT, strm_name_len * 2))
		filename = ".";
	else if (!memcmp(dentry->name_unicode, MSDOS_DOTDOT,
			 strm_name_len * 2))
		filename = "..";
	else
		return 0;

	sprintf(error_msg, "ERROR: '%s' filename is not allowed.\n"
			" [1] Insert the name you want to rename.\n"
			" [2] Automatically renames filename.\n"
			" [3] Bypass this check(No repair)\n", filename);
ask_again:
	num = exfat_repair_ask(&exfat_fsck, ER_DE_DOT_NAME,
			       error_msg);
	if (num) {
		__le16 utf16_name[ENTRY_NAME_MAX];
		char *rename = NULL;
		__u16 hash;
		struct exfat_dentry *stream_de;
		int name_len, ret;

		switch (num) {
		case 1:
			rename = get_rename_from_user(iter);
			break;
		case 2:
			rename = generate_rename(iter);
			break;
		case 3:
			break;
		default:
			exfat_info("select 1 or 2 number instead of %d\n", num);
			goto ask_again;
		}

		if (!rename)
			return -EINVAL;

		exfat_info("%s filename is renamed to %s\n", filename, rename);

		exfat_de_iter_get_dirty(iter, 2, &dentry);

		memset(utf16_name, 0, sizeof(utf16_name));
		ret = exfat_utf16_enc(rename, utf16_name, sizeof(utf16_name));
		free(rename);
		if (ret < 0)
			return ret;

		memcpy(dentry->name_unicode, utf16_name, ENTRY_NAME_MAX * 2);
		name_len = exfat_utf16_len(utf16_name, ENTRY_NAME_MAX * 2);
		hash = exfat_calc_name_hash(iter->exfat, utf16_name, (int)name_len);
		exfat_de_iter_get_dirty(iter, 1, &stream_de);
		stream_de->stream_name_len = (__u8)name_len;
		stream_de->stream_name_hash = cpu_to_le16(hash);
	}

	return 0;
}