From 4b1a1bdca9ebea13b13f8d874e860e71b2d9b828 Mon Sep 17 00:00:00 2001 From: Old-Ding <35417409+Old-Ding@users.noreply.github.com> Date: Mon, 6 Jul 2026 06:56:12 +0800 Subject: [PATCH] fs/partition: bound TXTABLE partition names Limit the parsed TXTABLE name field to NAME_MAX and reject entries that do not provide all three required fields. This avoids writing past struct partition_s.name when a text partition table contains an overlong name. Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com> --- fs/partition/fs_txtable.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/partition/fs_txtable.c b/fs/partition/fs_txtable.c index fdba147d505..b1eb21f2d6d 100644 --- a/fs/partition/fs_txtable.c +++ b/fs/partition/fs_txtable.c @@ -30,6 +30,7 @@ #include #include +#include #include "partition.h" #include "fs_heap.h" @@ -44,6 +45,7 @@ #define TXTABLE_MAGIC "TXTABLE0" #define TXTABLE_LENGTH (state->erasesize + 1) +#define TXTABLE_NAME_FMT "%" STRINGIFY(NAME_MAX) "s" /**************************************************************************** * Public Functions @@ -157,12 +159,13 @@ int parse_txtable_partition(FAR struct partition_state_s *state, break; } - ret = sscanf(token, "%s %zx %zx", + ret = sscanf(token, TXTABLE_NAME_FMT " %zx %zx", part[i].name, &part[i].nblocks, &part[i].firstblock); - if (ret < 0) + if (ret != 3) { + ret = -EFTYPE; goto out; }