fs: fuse: Fix possible buffer overflow #63079
Conversation
subsys/fs/fuse_fs_access.c
Outdated
| sprintf(mount_path, "%.*s/", MIN(strlen(path), | ||
| (PATH_MAX - 2)), path); |
There was a problem hiding this comment.
I think it would be more proper to check first whether the additional '/' fits with string to the mount point and use strcpy, or similar rather than heavy snprintf, and fill in missing '/'.
Above is also dangerous because you can get path that is still existing path, but not a path you want to access.
For example you can cut something like "/bi/ba/bu" to "/bi/ba//" which is still valid path.
There was a problem hiding this comment.
yep ... thought about it but decided to just truncate the contents and send to the upper level to keep it as closes as the original implementation ...
But it is probably better just return an error here and avoid propagate inaccurate data.
Ensure that the path in fuse_fs_access_readdir does not overflow the local buffer. Signed-off-by: Flavio Ceolin <[email protected]>
| @@ -176,9 +176,15 @@ static int fuse_fs_access_readdir(const char *path, void *buf, | |||
| * directory but FUSE strips the trailing slashes from | |||
| * directory names so add it back. | |||
| */ | |||
| char mount_path[PATH_MAX]; | |||
| char mount_path[PATH_MAX] = {0}; | |||
There was a problem hiding this comment.
Note for the future: if you are planning to overwrite the buffer with whatevercpy do not initialize it this way, because this will be replaced by loop putting 0 in the array; just do all the copy you need and then place the final 0 where it belongs, as you will know where to place it anyway.
|
|
||
| sprintf(mount_path, "%s/", path); | ||
| if (len >= (PATH_MAX - 2)) { |
There was a problem hiding this comment.
if (len > (PATH_MAX - 2)) { suffices, leaving one byte for / and \0 each.
| return -ENOMEM; | ||
| } | ||
|
|
||
| memcpy(mount_path, path, len) |
There was a problem hiding this comment.
missing semicolon, did this patch pass CI?
There was a problem hiding this comment.
clearly the CI is not running this code path, could you send a PR with the fix?
Ensure that the path in fuse_fs_access_readdir does not overflow the local buffer.