From 54cf8d349e30557c10f41132bf6531762918f39c Mon Sep 17 00:00:00 2001 From: Eun0us Date: Tue, 10 Feb 2026 01:39:19 +0100 Subject: [PATCH] fix: prevent stack buffer overflow in spiffs_read_dir_v() Replace unbounded strcpy with strncpy + explicit NUL termination when copying the object name from flash into spiffs_dirent. The name field read from raw flash may not be NUL-terminated, causing strcpy to read past the end of the stack-allocated objix_hdr variable. This matches the pattern already used in the write path (commit 8eb5cd3, spiffs_nucleus.c:1018). Fixes pellepl/spiffs#302 --- src/spiffs_hydrogen.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/spiffs_hydrogen.c b/src/spiffs_hydrogen.c index 3b5629d..251a9a6 100644 --- a/src/spiffs_hydrogen.c +++ b/src/spiffs_hydrogen.c @@ -1083,7 +1083,8 @@ static s32_t spiffs_read_dir_v( (SPIFFS_PH_FLAG_DELET | SPIFFS_PH_FLAG_IXDELE)) { struct spiffs_dirent *e = (struct spiffs_dirent*)user_var_p; e->obj_id = obj_id; - strcpy((char *)e->name, (char *)objix_hdr.name); + strncpy((char *)e->name, (char *)objix_hdr.name, sizeof(e->name) - 1); + e->name[sizeof(e->name) - 1] = '\0'; e->type = objix_hdr.type; e->size = objix_hdr.size == SPIFFS_UNDEFINED_LEN ? 0 : objix_hdr.size; e->pix = pix;