From e76defd75cb2a7bc2802fa44d68bf41ac29ffdd5 Mon Sep 17 00:00:00 2001 From: Christopher Williams Date: Tue, 24 Sep 2019 17:24:42 -0700 Subject: [PATCH] R0.13c patch 5 August 30, 2019 Wrong memory read one or more characters beyond end of the input path name. If the memory area following the string terminator is filled by / or \, it can cause memory protection fault or bus fault. --- source/ff.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/source/ff.c b/source/ff.c index 4a1a2bf..3b8de54 100644 --- a/source/ff.c +++ b/source/ff.c @@ -2851,9 +2851,13 @@ static FRESULT create_name ( /* FR_OK: successful, FR_INVALID_NAME: could not cr if (di >= FF_MAX_LFN) return FR_INVALID_NAME; /* Reject too long name */ lfn[di++] = wc; /* Store the Unicode character */ } - while (*p == '/' || *p == '\\') p++; /* Skip duplicated separators if exist */ - *path = p; /* Return pointer to the next segment */ - cf = (wc < ' ') ? NS_LAST : 0; /* Set last segment flag if end of the path */ + if (wc < ' ') { /* End of path? */ + cf = NS_LAST; /* Set last segment flag */ + } else { + cf = 0; /* Next segment follows */ + while (*p == '/' || *p == '\\') p++; /* Skip duplicated separators if exist */ + } + *path = p; /* Return pointer to the next segment */ #if FF_FS_RPATH != 0 if ((di == 1 && lfn[di - 1] == '.') ||