From 29943546343c92334e8518695a11fc0e2ceea68b Mon Sep 17 00:00:00 2001 From: Junwha Date: Wed, 3 Jan 2024 02:25:28 +0900 Subject: [PATCH] extmod/vfs: Fix buffer overflow of string comparison in umount. The comparison between the given unmount string and existing mount strings were made by the given string, which leads to buffer overflow. Fixes issue #13006. Signed-off-by: Junwha --- extmod/vfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/extmod/vfs.c b/extmod/vfs.c index 5d564459c..e545c9af9 100644 --- a/extmod/vfs.c +++ b/extmod/vfs.c @@ -273,7 +273,7 @@ mp_obj_t mp_vfs_umount(mp_obj_t mnt_in) { mnt_str = mp_obj_str_get_data(mnt_in, &mnt_len); } for (mp_vfs_mount_t **vfsp = &MP_STATE_VM(vfs_mount_table); *vfsp != NULL; vfsp = &(*vfsp)->next) { - if ((mnt_str != NULL && !memcmp(mnt_str, (*vfsp)->str, mnt_len + 1)) || (*vfsp)->obj == mnt_in) { + if ((mnt_str != NULL && mnt_len == (*vfsp)->len && !memcmp(mnt_str, (*vfsp)->str, mnt_len)) || (*vfsp)->obj == mnt_in) { vfs = *vfsp; *vfsp = (*vfsp)->next; break;