From c3247ecc6c1c1bc35ac297f540e695326d65692b Mon Sep 17 00:00:00 2001 From: Jukka Laitinen Date: Tue, 25 Nov 2025 13:41:28 +0200 Subject: [PATCH] nshlib/nsh_fscmds.c: Allocate a PATH_MAX sized buffer for unlink_recursive This fixes heap corruption when deleting a folder containing other folders or files. The issue appeared at commit 131d50ae9d76e4, which removed the stack-based temporary buffer. unlink_recursive requires that the path is provided in PATH_MAX sized buffer. It concatenates sub-folder or file names to the same buffer. nsh_getfullpath just allocates a buffer using strdup, so there is no room for concatenating more data to it. To keep the stack usage smaller, instead of reverting the breaking commit, allocate the temporary buffer with lib_get_pathbuffer instead. Signed-off-by: Jukka Laitinen --- nshlib/nsh_fscmds.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nshlib/nsh_fscmds.c b/nshlib/nsh_fscmds.c index 3eb41c377..1c705befe 100644 --- a/nshlib/nsh_fscmds.c +++ b/nshlib/nsh_fscmds.c @@ -2233,7 +2233,10 @@ int cmd_rm(FAR struct nsh_vtbl_s *vtbl, int argc, FAR char **argv) { if (recursive) { - ret = unlink_recursive(fullpath, &stat); + FAR char *buf = lib_get_pathbuffer(); + strlcpy(buf, fullpath, PATH_MAX); + ret = unlink_recursive(buf, &stat); + lib_put_pathbuffer(buf); } else {