You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nuttx.apache.org by xi...@apache.org on 2026/10/21 02:03:53 UTC
(nuttx) branch master updated (1738e6fdf1c -> 3173a0c2cba)
This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
from 1738e6fdf1c sys/types.h: move CONFIG_INIT_ENTRYPOINT declaration out of sys/types.h
new 5e303d3cd2f fs/romfs: Fix the nxstyle error in fs_romfsutil.c.
new 3173a0c2cba fs/romfs: Do not read outside of the volume.
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
fs/romfs/fs_romfsutil.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
(nuttx) 02/02: fs/romfs: Do not read outside of the volume.
Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 3173a0c2cba9996009d07cfdd55b71d9eefdbb4c
Author: Marco Casaroli <ma...@gmail.com>
AuthorDate: Mon Oct 19 02:03:58 2026 +0200
fs/romfs: Do not read outside of the volume.
ROMFS takes the offsets of file headers, hard link targets and names
from the image, and romfs_devcacheread() did not check them. In XIP
mode it added the offset to the image address, so a damaged image
gave a bad pointer and the kernel stopped with a load exception. For
example, an image with no entries puts the root directory at the end
of the volume. The mount then reads the data after the image and
follows it as a hard link.
romfs_devcacheread() now returns -EIO if the 16-byte chunk at the
offset is not fully in the volume. The mount or the lookup then fails
and the system continues. romfs_datastart() already does the same
check.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Marco Casaroli <ma...@gmail.com>
---
fs/romfs/fs_romfsutil.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/fs/romfs/fs_romfsutil.c b/fs/romfs/fs_romfsutil.c
index 17a1c9309c5..c85c343ecaa 100644
--- a/fs/romfs/fs_romfsutil.c
+++ b/fs/romfs/fs_romfsutil.c
@@ -173,6 +173,17 @@ static int16_t romfs_devcacheread(FAR struct romfs_mountpt_s *rm,
uint32_t sector;
int ret;
+ /* The offset comes from the image. Do not read a 16-byte chunk outside
+ * of the volume. rm_volsize is zero only while the header is read.
+ */
+
+ if (rm->rm_volsize != 0 &&
+ (offset >= rm->rm_volsize ||
+ rm->rm_volsize - offset < ROMFS_ALIGNMENT))
+ {
+ return -EIO;
+ }
+
/* rm->rm_cachesector holds the current sector that is buffer in or
* referenced by rm->rm_buffer. If the requested sector is the same as this
* this then we do nothing.
(nuttx) 01/02: fs/romfs: Fix the nxstyle error in fs_romfsutil.c.
Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 5e303d3cd2f68d3d62a1a3a67101dbdb01ee608e
Author: Marco Casaroli <ma...@gmail.com>
AuthorDate: Mon Oct 19 02:03:21 2026 +0200
fs/romfs: Fix the nxstyle error in fs_romfsutil.c.
Put the body of a while loop on its own line in braces. This error
is older than the next change. This change does not change the code.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Marco Casaroli <ma...@gmail.com>
---
fs/romfs/fs_romfsutil.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/romfs/fs_romfsutil.c b/fs/romfs/fs_romfsutil.c
index fc081f61710..17a1c9309c5 100644
--- a/fs/romfs/fs_romfsutil.c
+++ b/fs/romfs/fs_romfsutil.c
@@ -967,7 +967,10 @@ int romfs_finddirentry(FAR struct romfs_mountpt_s *rm,
{
/* Find the start of the next path component */
- while (*entryname == '/') entryname++;
+ while (*entryname == '/')
+ {
+ entryname++;
+ }
/* Find the end of the next path component */