Github/fatfs
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

R0.13c patch 5

Browse Source 
August 30, 2019

Wrong memory read one or more characters beyond end of the input path name.
If the memory area following the string terminator is filled by / or \, it can cause memory
protection fault or bus fault.
This commit is contained in:
Christopher Williams
2019-09-24 17:24:42 -07:00
parent 5da8c4a4b9
commit e76defd75c
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
source/ff.c
+7 -3
View File
@@ -2851,9 +2851,13 @@ static FRESULT create_name ( /* FR_OK: successful, FR_INVALID_NAME: could not cr
if (di >= FF_MAX_LFN) return FR_INVALID_NAME; /* Reject too long name */ if (di >= FF_MAX_LFN) return FR_INVALID_NAME; /* Reject too long name */
lfn[di++] = wc; /* Store the Unicode character */ lfn[di++] = wc; /* Store the Unicode character */
} }
while (*p == '/' || *p == '\\') p++; /* Skip duplicated separators if exist */ if (wc < ' ') { /* End of path? */
*path = p; /* Return pointer to the next segment */ cf = NS_LAST; /* Set last segment flag */
cf = (wc < ' ') ? NS_LAST : 0; /* Set last segment flag if end of the path */ } else {
cf = 0; /* Next segment follows */
while (*p == '/' || *p == '\\') p++; /* Skip duplicated separators if exist */
}
*path = p; /* Return pointer to the next segment */
#if FF_FS_RPATH != 0 #if FF_FS_RPATH != 0
if ((di == 1 && lfn[di - 1] == '.') || if ((di == 1 && lfn[di - 1] == '.') ||