mirror of
https://github.com/pellepl/spiffs.git
synced 2026-09-24 18:07:34 +00:00
Fix non-NUL-terminated name in spiffs_stat_pix()
spiffs_stat_pix() (used by SPIFFS_stat() and SPIFFS_fstat()) copied
objix_hdr.name into s->name with a plain strncpy(..., SPIFFS_OBJ_NAME_LEN),
which reads the source straight from raw flash. If that flash-resident
name has no embedded NUL within its SPIFFS_OBJ_NAME_LEN bytes (e.g. a
corrupted/fuzzed image), the copy leaves s->name with no terminator
either, and name occupies the last field of spiffs_stat under the
default config, so any later strlen()/strcmp()/printf("%s", ...) on
stat.name runs off the end of the struct.
Apply the same truncate-to-sizeof-1-plus-explicit-NUL pattern already
used by the two sibling call sites (spiffs_object_update_index_hdr in
spiffs_nucleus.c, and spiffs_read_dir_v in this same file) so the field
is always properly terminated, while normal short names are copied
byte-for-byte unchanged.
Fixes #262
This commit is contained in:
@@ -783,7 +783,8 @@ static s32_t spiffs_stat_pix(spiffs *fs, spiffs_page_ix pix, spiffs_file fh, spi
|
||||
s->type = objix_hdr.type;
|
||||
s->size = objix_hdr.size == SPIFFS_UNDEFINED_LEN ? 0 : objix_hdr.size;
|
||||
s->pix = pix;
|
||||
strncpy((char *)s->name, (char *)objix_hdr.name, SPIFFS_OBJ_NAME_LEN);
|
||||
strncpy((char *)s->name, (char *)objix_hdr.name, sizeof(s->name) - 1);
|
||||
s->name[sizeof(s->name) - 1] = '\0';
|
||||
#if SPIFFS_OBJ_META_LEN
|
||||
_SPIFFS_MEMCPY(s->meta, objix_hdr.meta, SPIFFS_OBJ_META_LEN);
|
||||
#endif
|
||||
|
||||
Reference in New Issue
Block a user