Aksal/nuttx-apps
1
0
Fork 1
mirror of https://github.com/apache/nuttx-apps.git synced 2026-08-01 20:29:00 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

system: fastboot: bound filedump path parsing

Browse source 
Parse the filedump path token into the existing PATH_MAX-sized buffer
before reading the optional offset and size arguments. This bounds the
write without constructing a scanf format string at runtime.

Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
This commit is contained in:
Old-Ding 2026-07-11 12:59:27 +08:00 • committed by Xiang Xiao
parent eceb30e59c
commit 62d04ed484
1 changed files with 21 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

25
system/fastboot/fastboot.c
View file

@ -871,6 +871,7 @@ static void fastboot_filedump(FAR struct fastboot_ctx_s *ctx,
FAR const char *arg)
{
struct stat sb;
size_t len;
int ret;
if (!arg)
@ -879,14 +880,30 @@ static void fastboot_filedump(FAR struct fastboot_ctx_s *ctx,
return;
}
ret = sscanf(arg, "%s %" PRIdOFF " %zu", ctx->upload_param.u.file.path,
&ctx->upload_param.u.file.offset, &ctx->upload_param.size);
if (ret != 1 && ret != 3)
arg += strspn(arg, " \t\r\n");
len = strcspn(arg, " \t\r\n");
if (len == 0)
{
fastboot_fail(ctx, "Failed to parse arguments");
return;
}
else if (ret == 1)
if (len >= sizeof(ctx->upload_param.u.file.path))
{
len = sizeof(ctx->upload_param.u.file.path) - 1;
}
memcpy(ctx->upload_param.u.file.path, arg, len);
ctx->upload_param.u.file.path[len] = '\0';
ret = sscanf(arg + len, "%" PRIdOFF " %zu",
&ctx->upload_param.u.file.offset, &ctx->upload_param.size);
if (ret != EOF && ret != 0 && ret != 2)
{
fastboot_fail(ctx, "Failed to parse arguments");
return;
}
else if (ret != 2)
{
ret = stat(ctx->upload_param.u.file.path, &sb);
if (ret < 0)