From 1da0bb7129c1c5dc7bf91816ac75b43f83527b46 Mon Sep 17 00:00:00 2001
From: 94xhn <87560781+94xhn@users.noreply.github.com>
Date: Mon, 13 Jul 2026 13:26:00 +0800
Subject: [PATCH] Fix non-NUL-terminated name in spiffs_stat_pix()

spiffs_stat_pix() (used by SPIFFS_stat() and SPIFFS_fstat()) copied
objix_hdr.name into s->name with a plain strncpy(..., SPIFFS_OBJ_NAME_LEN),
which reads the source straight from raw flash. If that flash-resident
name has no embedded NUL within its SPIFFS_OBJ_NAME_LEN bytes (e.g. a
corrupted/fuzzed image), the copy leaves s->name with no terminator
either, and name occupies the last field of spiffs_stat under the
default config, so any later strlen()/strcmp()/printf("%s", ...) on
stat.name runs off the end of the struct.

Apply the same truncate-to-sizeof-1-plus-explicit-NUL pattern already
used by the two sibling call sites (spiffs_object_update_index_hdr in
spiffs_nucleus.c, and spiffs_read_dir_v in this same file) so the field
is always properly terminated, while normal short names are copied
byte-for-byte unchanged.

Fixes #262
---
 src/spiffs_hydrogen.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/spiffs_hydrogen.c b/src/spiffs_hydrogen.c
index a0565ea..5e299b1 100644
--- a/src/spiffs_hydrogen.c
+++ b/src/spiffs_hydrogen.c
@@ -783,7 +783,8 @@ static s32_t spiffs_stat_pix(spiffs *fs, spiffs_page_ix pix, spiffs_file fh, spi
   s->type = objix_hdr.type;
   s->size = objix_hdr.size == SPIFFS_UNDEFINED_LEN ? 0 : objix_hdr.size;
   s->pix = pix;
-  strncpy((char *)s->name, (char *)objix_hdr.name, SPIFFS_OBJ_NAME_LEN);
+  strncpy((char *)s->name, (char *)objix_hdr.name, sizeof(s->name) - 1);
+  s->name[sizeof(s->name) - 1] = '\0';
 #if SPIFFS_OBJ_META_LEN
   _SPIFFS_MEMCPY(s->meta, objix_hdr.meta, SPIFFS_OBJ_META_LEN);
 #endif