From e41c7f7b4ef6fb4fa89711dfeb93b24749b911b2 Mon Sep 17 00:00:00 2001 From: hardik-devops Date: Tue, 30 Jun 2026 00:05:08 +0530 Subject: [PATCH] fix: stack-buffer-overflow in UtAssert_StringBufCompare (#1550), wrong statvfs block size field (#1547), and path traversal in OS_FileSys_FindVirtMountPoint (#1516) - utassert.c: clamp FormatLen1/FormatLen2 to sizeof(ScrubbedString)-1 before memcpy to prevent stack-buffer-overflow when caller-supplied String1Max/String2Max exceeds the 256-byte scrub buffers - os-impl-filesys.c (posix, qnx, rtems): use f_frsize instead of f_bsize as the block size when reporting statvfs results; f_frsize is the fundamental block size that correctly represents the physical size of storage blocks, while f_bsize is the preferred I/O transfer size and is not guaranteed to equal f_frsize on large drives - osapi-filesys.c: reject any virtual-mount-point path that contains a '..' component before prefix-matching to prevent path traversal attacks that could escape the virtual mount point boundary --- src/os/posix/src/os-impl-filesys.c | 2 +- src/os/qnx/src/os-impl-filesys.c | 2 +- src/os/rtems/src/os-impl-filesys.c | 2 +- src/os/shared/src/osapi-filesys.c | 21 +++++++++++++++++++++ ut_assert/src/utassert.c | 10 ++++++++++ 5 files changed, 34 insertions(+), 3 deletions(-) diff --git a/src/os/posix/src/os-impl-filesys.c b/src/os/posix/src/os-impl-filesys.c index a08119ca8..2bc031df6 100644 --- a/src/os/posix/src/os-impl-filesys.c +++ b/src/os/posix/src/os-impl-filesys.c @@ -321,7 +321,7 @@ int32 OS_FileSysStatVolume_Impl(const OS_object_token_t *token, OS_statvfs_t *re return OS_ERROR; } - result->block_size = OSAL_SIZE_C(stat_buf.f_bsize); + result->block_size = OSAL_SIZE_C(stat_buf.f_frsize); result->blocks_free = OSAL_BLOCKCOUNT_C(stat_buf.f_bfree); result->total_blocks = OSAL_BLOCKCOUNT_C(stat_buf.f_blocks); diff --git a/src/os/qnx/src/os-impl-filesys.c b/src/os/qnx/src/os-impl-filesys.c index d1a1cca64..8ec095ce0 100644 --- a/src/os/qnx/src/os-impl-filesys.c +++ b/src/os/qnx/src/os-impl-filesys.c @@ -326,7 +326,7 @@ int32 OS_FileSysStatVolume_Impl(const OS_object_token_t *token, OS_statvfs_t *re return OS_ERROR; } - result->block_size = OSAL_SIZE_C(stat_buf.f_bsize); + result->block_size = OSAL_SIZE_C(stat_buf.f_frsize); result->blocks_free = OSAL_BLOCKCOUNT_C(stat_buf.f_bfree); result->total_blocks = OSAL_BLOCKCOUNT_C(stat_buf.f_blocks); diff --git a/src/os/rtems/src/os-impl-filesys.c b/src/os/rtems/src/os-impl-filesys.c index 9cfe312b6..f6c12b61e 100644 --- a/src/os/rtems/src/os-impl-filesys.c +++ b/src/os/rtems/src/os-impl-filesys.c @@ -407,7 +407,7 @@ int32 OS_FileSysStatVolume_Impl(const OS_object_token_t *token, OS_statvfs_t *re } else { - result->block_size = stat_buf.f_bsize; + result->block_size = stat_buf.f_frsize; result->blocks_free = stat_buf.f_bfree; result->total_blocks = stat_buf.f_blocks; diff --git a/src/os/shared/src/osapi-filesys.c b/src/os/shared/src/osapi-filesys.c index 8f3d6a7a8..3978a8506 100644 --- a/src/os/shared/src/osapi-filesys.c +++ b/src/os/shared/src/osapi-filesys.c @@ -88,6 +88,7 @@ bool OS_FileSys_FindVirtMountPoint(void *ref, const OS_object_token_t *token, co { OS_filesys_internal_record_t *filesys; const char *target = (const char *)ref; + const char *p; size_t mplen; filesys = OS_OBJECT_TABLE_GET(OS_filesys_table, *token); @@ -97,6 +98,26 @@ bool OS_FileSys_FindVirtMountPoint(void *ref, const OS_object_token_t *token, co return false; } + /* + * Reject any path that contains a ".." component to prevent path + * traversal attacks that could escape the virtual mount point (#1516). + * Check for "/../", leading "/../", and trailing "/.." + */ + p = target; + while (*p != 0) + { + if (p[0] == '/' && p[1] == '.' && p[2] == '.' && (p[3] == '/' || p[3] == 0)) + { + return false; + } + ++p; + } + /* Also reject a path that starts with "../" or is exactly ".." */ + if (target[0] == '.' && target[1] == '.' && (target[2] == '/' || target[2] == 0)) + { + return false; + } + mplen = OS_strnlen(filesys->virtual_mountpt, sizeof(filesys->virtual_mountpt)); /* diff --git a/ut_assert/src/utassert.c b/ut_assert/src/utassert.c index 227d64d00..36d444754 100644 --- a/ut_assert/src/utassert.c +++ b/ut_assert/src/utassert.c @@ -758,6 +758,11 @@ bool UtAssert_StringBufCompare(const char *String1, /* Check for a newline within the string, and if present, end the string there instead */ if (FormatLen1 > 0) { + /* Clamp to buffer capacity before any memcpy to prevent stack-buffer-overflow (#1550) */ + if (FormatLen1 > sizeof(ScrubbedString1) - 1) + { + FormatLen1 = sizeof(ScrubbedString1) - 1; + } EndPtr1 = memchr(String1, '\n', FormatLen1); if (EndPtr1 != NULL) { @@ -769,6 +774,11 @@ bool UtAssert_StringBufCompare(const char *String1, if (FormatLen2 > 0) { + /* Clamp to buffer capacity before any memcpy to prevent stack-buffer-overflow (#1550) */ + if (FormatLen2 > sizeof(ScrubbedString2) - 1) + { + FormatLen2 = sizeof(ScrubbedString2) - 1; + } EndPtr2 = memchr(String2, '\n', FormatLen2); if (EndPtr2 != NULL) {