Fix non-NUL-terminated name in spiffs_stat_pix()

spiffs_stat_pix() (used by SPIFFS_stat() and SPIFFS_fstat()) copied
objix_hdr.name into s->name with a plain strncpy(..., SPIFFS_OBJ_NAME_LEN),
which reads the source straight from raw flash. If that flash-resident
name has no embedded NUL within its SPIFFS_OBJ_NAME_LEN bytes (e.g. a
corrupted/fuzzed image), the copy leaves s->name with no terminator
either, and name occupies the last field of spiffs_stat under the
default config, so any later strlen()/strcmp()/printf("%s", ...) on
stat.name runs off the end of the struct.

Apply the same truncate-to-sizeof-1-plus-explicit-NUL pattern already
used by the two sibling call sites (spiffs_object_update_index_hdr in
spiffs_nucleus.c, and spiffs_read_dir_v in this same file) so the field
is always properly terminated, while normal short names are copied
byte-for-byte unchanged.

Fixes #262
This commit is contained in:
94xhn
2026-07-13 13:26:00 +08:00
parent 41f4c9f706
commit 1da0bb7129
+2 -1
View File
@@ -783,7 +783,8 @@ static s32_t spiffs_stat_pix(spiffs *fs, spiffs_page_ix pix, spiffs_file fh, spi
s->type = objix_hdr.type;
s->size = objix_hdr.size == SPIFFS_UNDEFINED_LEN ? 0 : objix_hdr.size;
s->pix = pix;
strncpy((char *)s->name, (char *)objix_hdr.name, SPIFFS_OBJ_NAME_LEN);
strncpy((char *)s->name, (char *)objix_hdr.name, sizeof(s->name) - 1);
s->name[sizeof(s->name) - 1] = '\0';
#if SPIFFS_OBJ_META_LEN
_SPIFFS_MEMCPY(s->meta, objix_hdr.meta, SPIFFS_OBJ_META_LEN);
#endif