fengqi/lv_micropython
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

extmod/vfs: Fix buffer overflow of string comparison in umount.

Browse Source 
The comparison between the given unmount string and existing mount strings
were made by the given string, which leads to buffer overflow.

Fixes issue #13006.

Signed-off-by: Junwha <qbit@unist.ac.kr>
This commit is contained in:
Junwha 2024-01-03 02:25:28 +09:00 committed by Damien George
parent 390390ec37
commit 2994354634
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
extmod/vfs.c
View File

@ -273,7 +273,7 @@ mp_obj_t mp_vfs_umount(mp_obj_t mnt_in) {
mnt_str = mp_obj_str_get_data(mnt_in, &mnt_len); mnt_str = mp_obj_str_get_data(mnt_in, &mnt_len);
} }
for (mp_vfs_mount_t **vfsp = &MP_STATE_VM(vfs_mount_table); *vfsp != NULL; vfsp = &(*vfsp)->next) { for (mp_vfs_mount_t **vfsp = &MP_STATE_VM(vfs_mount_table); *vfsp != NULL; vfsp = &(*vfsp)->next) {
if ((mnt_str != NULL && !memcmp(mnt_str, (*vfsp)->str, mnt_len + 1)) || (*vfsp)->obj == mnt_in) { if ((mnt_str != NULL && mnt_len == (*vfsp)->len && !memcmp(mnt_str, (*vfsp)->str, mnt_len)) || (*vfsp)->obj == mnt_in) {
vfs = *vfsp; vfs = *vfsp;
*vfsp = (*vfsp)->next; *vfsp = (*vfsp)->next;
break; break;