unimg: harden LFN parsing (seq bounds, checksum, dotfiles, non-ASCII fallback) and dedup char loop

programs/cmm/misc/unimg.c

@@ -94,6 +94,9 @@ int fat_off;
 int root_off;
 int data_off;
 
+int lfn_nonascii;
+int lfn_checksum;
+
 char cur_path[4096];
 int  cur_path_len;
 
@@ -210,22 +213,17 @@ int entry_short_name(int off, dword out)
 int get_lfn_chars(int off, dword out)
 {
 	int i, c, pos;
-	pos = 0;
-
-	for (i = 1; i < 11; i += 2) {
+	// LFN stores 13 UCS-2 chars at non-contiguous offsets 1..10, 14..25, 28..31
+	// (gaps: 11..13 attr/type/checksum, 26..27 cluster).
+	i = 1;
+	for (pos = 0; pos < 13; pos++) {
 		c = fat_u16(off + i);
 		if (c == 0x0000) || (c == 0xFFFF) { ESBYTE[out+pos] = 0; return pos; }
-		ESBYTE[out + pos] = c & 0xFF; pos++;
-	}
-	for (i = 14; i < 26; i += 2) {
-		c = fat_u16(off + i);
-		if (c == 0x0000) || (c == 0xFFFF) { ESBYTE[out+pos] = 0; return pos; }
-		ESBYTE[out + pos] = c & 0xFF; pos++;
-	}
-	for (i = 28; i < 32; i += 2) {
-		c = fat_u16(off + i);
-		if (c == 0x0000) || (c == 0xFFFF) { ESBYTE[out+pos] = 0; return pos; }
-		ESBYTE[out + pos] = c & 0xFF; pos++;
+		if (c > 0x7F) lfn_nonascii = 1;
+		ESBYTE[out + pos] = c & 0xFF;
+		i += 2;
+		if (i == 11) i = 14;
+		if (i == 26) i = 28;
 	}
 	ESBYTE[out + pos] = 0;
 	return pos;
@@ -246,7 +244,10 @@ int process_one_entry(int entry_off, dword lfn_buf, dword p_seq)
 		seq = b;
 		if (seq & 0x40) {
 			seq &= 0x3F;
+			if (seq < 1) || (seq > 20) { ESDWORD[p_seq] = -1; return 0; }
 			ESDWORD[p_seq] = seq;
+			lfn_nonascii = 0;
+			lfn_checksum = fat_u8(entry_off + 13);
 			EDI = lfn_buf; ECX = 65; EAX = 0; MEMSETD(EDI, ECX, EAX);
 		}
 		if (seq == ESDWORD[p_seq]) {
@@ -273,7 +274,7 @@ int process_one_entry(int entry_off, dword lfn_buf, dword p_seq)
 int handle_entry(int off, dword lfn_name)
 {
 	char  name[256];
-	int   nlen, attr, cluster, size, saved_len;
+	int   nlen, attr, cluster, size, saved_len, use_lfn, sum, hi, i;
 	dword buf;
 
 	if (off < 0) || (off + 32 > img_sz) {
@@ -283,8 +284,23 @@ int handle_entry(int off, dword lfn_name)
 	attr = fat_u8(off + 11);
 	if (attr == 0x0F) return 0;
 
-	if (lfn_name) && (ESBYTE[lfn_name]) {
-		strcpy(#name, lfn_name);
+	// Verify LFN checksum against the short-name field (off..off+10).
+	use_lfn = 0;
+	if (lfn_name) && (ESBYTE[lfn_name]) && (!lfn_nonascii) {
+		sum = 0;
+		for (i = 0; i < 11; i++) {
+			hi = sum & 1;
+			hi = hi << 7;
+			sum = sum >> 1;
+			sum = sum + hi;
+			sum = sum + fat_u8(off + i);
+			sum = sum & 0xFF;
+		}
+		if (sum == lfn_checksum) use_lfn = 1;
+	}
+
+	if (use_lfn) {
+		strncpy(#name, lfn_name, 255);
 		nlen = strlen(#name);
 	} else {
 		nlen = entry_short_name(off, #name);
@@ -292,7 +308,9 @@ int handle_entry(int off, dword lfn_name)
 		if (nlen == 0) return 0;
 	}
 
-	if (name[0] == '.') return 0;
+	// Skip only the "." and ".." directory entries (a real LFN name may start with '.').
+	if (name[0] == '.') && (name[1] == '\0') return 0;
+	if (name[0] == '.') && (name[1] == '.') && (name[2] == '\0') return 0;
 
 	cluster = fat_u16(off + 26);
 
@@ -410,4 +428,4 @@ void main()
 	}
 
 	NotifyAndExit(MSG_DONE, #cur_path);
-}
+}