fix: stack-buffer-overflow (#1550), wrong statvfs block_size (#1547), path traversal (#1516)

src/os/posix/src/os-impl-filesys.c

@@ -321,7 +321,7 @@ int32 OS_FileSysStatVolume_Impl(const OS_object_token_t *token, OS_statvfs_t *re
         return OS_ERROR;
     }
 
-    result->block_size   = OSAL_SIZE_C(stat_buf.f_bsize);
+    result->block_size   = OSAL_SIZE_C(stat_buf.f_frsize);
     result->blocks_free  = OSAL_BLOCKCOUNT_C(stat_buf.f_bfree);
     result->total_blocks = OSAL_BLOCKCOUNT_C(stat_buf.f_blocks);
 

src/os/qnx/src/os-impl-filesys.c

@@ -326,7 +326,7 @@ int32 OS_FileSysStatVolume_Impl(const OS_object_token_t *token, OS_statvfs_t *re
         return OS_ERROR;
     }
 
-    result->block_size   = OSAL_SIZE_C(stat_buf.f_bsize);
+    result->block_size   = OSAL_SIZE_C(stat_buf.f_frsize);
     result->blocks_free  = OSAL_BLOCKCOUNT_C(stat_buf.f_bfree);
     result->total_blocks = OSAL_BLOCKCOUNT_C(stat_buf.f_blocks);
 

src/os/rtems/src/os-impl-filesys.c

@@ -407,7 +407,7 @@ int32 OS_FileSysStatVolume_Impl(const OS_object_token_t *token, OS_statvfs_t *re
     }
     else
     {
-        result->block_size   = stat_buf.f_bsize;
+        result->block_size   = stat_buf.f_frsize;
         result->blocks_free  = stat_buf.f_bfree;
         result->total_blocks = stat_buf.f_blocks;
 

src/os/shared/src/osapi-filesys.c

@@ -88,6 +88,7 @@ bool OS_FileSys_FindVirtMountPoint(void *ref, const OS_object_token_t *token, co
 {
     OS_filesys_internal_record_t *filesys;
     const char                   *target = (const char *)ref;
+    const char                   *p;
     size_t                        mplen;
 
     filesys = OS_OBJECT_TABLE_GET(OS_filesys_table, *token);
@@ -97,6 +98,26 @@ bool OS_FileSys_FindVirtMountPoint(void *ref, const OS_object_token_t *token, co
         return false;
     }
 
+    /*
+     * Reject any path that contains a ".." component to prevent path
+     * traversal attacks that could escape the virtual mount point (#1516).
+     * Check for "/../", leading "/../", and trailing "/.."
+     */
+    p = target;
+    while (*p != 0)
+    {
+        if (p[0] == '/' && p[1] == '.' && p[2] == '.' && (p[3] == '/' || p[3] == 0))
+        {
+            return false;
+        }
+        ++p;
+    }
+    /* Also reject a path that starts with "../" or is exactly ".." */
+    if (target[0] == '.' && target[1] == '.' && (target[2] == '/' || target[2] == 0))
+    {
+        return false;
+    }
+
     mplen = OS_strnlen(filesys->virtual_mountpt, sizeof(filesys->virtual_mountpt));
 
     /*

ut_assert/src/utassert.c

@@ -758,6 +758,11 @@ bool UtAssert_StringBufCompare(const char        *String1,
     /* Check for a newline within the string, and if present, end the string there instead */
     if (FormatLen1 > 0)
     {
+        /* Clamp to buffer capacity before any memcpy to prevent stack-buffer-overflow (#1550) */
+        if (FormatLen1 > sizeof(ScrubbedString1) - 1)
+        {
+            FormatLen1 = sizeof(ScrubbedString1) - 1;
+        }
         EndPtr1 = memchr(String1, '\n', FormatLen1);
         if (EndPtr1 != NULL)
         {
@@ -769,6 +774,11 @@ bool UtAssert_StringBufCompare(const char        *String1,
 
     if (FormatLen2 > 0)
     {
+        /* Clamp to buffer capacity before any memcpy to prevent stack-buffer-overflow (#1550) */
+        if (FormatLen2 > sizeof(ScrubbedString2) - 1)
+        {
+            FormatLen2 = sizeof(ScrubbedString2) - 1;
+        }
         EndPtr2 = memchr(String2, '\n', FormatLen2);
         if (EndPtr2 != NULL)
         {