From ea03d06ab3baba763f80a124df994a8bcc78973c Mon Sep 17 00:00:00 2001 From: ligd Date: Tue, 11 Jul 2023 21:42:41 +0800 Subject: [PATCH] tmpfs: fix tmpfs_read overwrite after seek over tfo_size reproduce: fs = open("tmpfs", xx); lseek(fd, 256, SEEK_END); // filep->f_pos = size + 256 read(fd, buf, len); // overwrite resolve: directly return 0 when seek over tfo_size Signed-off-by: ligd --- fs/tmpfs/fs_tmpfs.c | 23 +++++++---------------- 1 file changed, 7 insertions(+), 16 deletions(-) diff --git a/fs/tmpfs/fs_tmpfs.c b/fs/tmpfs/fs_tmpfs.c index b477e890ece..d9d99ead36f 100644 --- a/fs/tmpfs/fs_tmpfs.c +++ b/fs/tmpfs/fs_tmpfs.c @@ -1467,6 +1467,13 @@ static ssize_t tmpfs_read(FAR struct file *filep, FAR char *buffer, tfo = filep->f_priv; + /* Directly return when the f_pos bigger then tfo_size */ + + if (filep->f_pos > tfo->tfo_size) + { + return 0; + } + /* Get exclusive access to the file */ ret = tmpfs_lock_file(tfo); @@ -1611,22 +1618,6 @@ static off_t tmpfs_seek(FAR struct file *filep, off_t offset, int whence) return -EINVAL; } - /* Attempts to set the position beyond the end of file will - * work if the file is open for write access. - * - * REVISIT: This simple implementation has no per-open storage that - * would be needed to retain the open flags. - */ - -#if 0 - if (position > tfo->tfo_size && (tfo->tfo_oflags & O_WROK) == 0) - { - /* Otherwise, the position is limited to the file size */ - - position = tfo->tfo_size; - } -#endif - /* Save the new file position */ filep->f_pos = position;