From c7cfc7367716dd9bf1028d16d0ba995e8c8cf399 Mon Sep 17 00:00:00 2001
From: 94xhn <94xhn1@gmail.com>
Date: Thu, 16 Jul 2026 14:30:44 +0800
Subject: [PATCH] fix: reject oversized metadata paths

SPIFFS_update_meta bypassed the object-name limit enforced by every
other path-based API. It returned NOT_FOUND after a lookup instead of
NAME_TOO_LONG for the first invalid length.

Constraint: Object names allow at most SPIFFS_OBJ_NAME_LEN - 1 bytes
Rejected: Bound strcmp calls | legal callers already limit names;
 strncmp could prefix-match corrupted entries
Confidence: high
Scope-risk: narrow
Directive: Keep path-length validation before SPIFFS_LOCK
Tested: WSL GCC default 91/91 and metadata 92/92;
 ASan focused name_too_long and update_meta
Not-tested: Physical flash hardware
---
 src/spiffs_hydrogen.c    | 3 +++
 src/test/test_hydrogen.c | 6 ++++++
 2 files changed, 9 insertions(+)

diff --git a/src/spiffs_hydrogen.c b/src/spiffs_hydrogen.c
index 5e299b1..4f3eae6 100644
--- a/src/spiffs_hydrogen.c
+++ b/src/spiffs_hydrogen.c
@@ -975,6 +975,9 @@ s32_t SPIFFS_update_meta(spiffs *fs, const char *name, const void *meta) {
 #else
   SPIFFS_API_CHECK_CFG(fs);
   SPIFFS_API_CHECK_MOUNT(fs);
+  if (strlen(name) > SPIFFS_OBJ_NAME_LEN - 1) {
+    SPIFFS_API_CHECK_RES(fs, SPIFFS_ERR_NAME_TOO_LONG);
+  }
   SPIFFS_LOCK(fs);
 
   spiffs_page_ix pix, pix_dummy;
diff --git a/src/test/test_hydrogen.c b/src/test/test_hydrogen.c
index 7a3b405..3bcd161 100644
--- a/src/test/test_hydrogen.c
+++ b/src/test/test_hydrogen.c
@@ -720,6 +720,12 @@ TEST(name_too_long) {
   TEST_CHECK_LT(SPIFFS_rename(FS, "a", name), SPIFFS_OK);
   TEST_CHECK_EQ(SPIFFS_errno(FS), SPIFFS_ERR_NAME_TOO_LONG);
 
+#if SPIFFS_OBJ_META_LEN
+  u8_t meta[SPIFFS_OBJ_META_LEN] = {0};
+  TEST_CHECK_LT(SPIFFS_update_meta(FS, name, meta), SPIFFS_OK);
+  TEST_CHECK_EQ(SPIFFS_errno(FS), SPIFFS_ERR_NAME_TOO_LONG);
+#endif
+
   return TEST_RES_OK;
 } TEST_END