mika/libnx
1
0
Fork 0
mirror of https://github.com/switchbrew/libnx.git synced 2025-06-23 05:12:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix strncat vulnerabilities in fs_dev.c [reported by @TuxSH]

Browse Source
This commit is contained in:
fincs 2018-05-02 16:09:11 +02:00
parent 2818c99dea
commit e001318c42
1 changed files with 2 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
nx/source/runtime/devices/fs_dev.c
View File

@ -106,7 +106,6 @@ static fsdev_fsdevice fsdev_fsdevices[32];
static char __cwd[PATH_MAX+1] = "/"; static char __cwd[PATH_MAX+1] = "/";
static __thread char __fixedpath[PATH_MAX+1]; static __thread char __fixedpath[PATH_MAX+1];
//static __thread uint16_t __utf16path[PATH_MAX+1];
static fsdev_fsdevice *fsdevFindDevice(const char *name) static fsdev_fsdevice *fsdevFindDevice(const char *name)
{ {
@ -201,7 +200,7 @@ fsdev_fixpath(struct _reent *r,
else else
{ {
strncpy(__fixedpath, __cwd, PATH_MAX); strncpy(__fixedpath, __cwd, PATH_MAX);
strncat(__fixedpath, path, PATH_MAX); strncat(__fixedpath, path, PATH_MAX - strlen(__cwd));
} }
if(__fixedpath[PATH_MAX] != 0) if(__fixedpath[PATH_MAX] != 0)
@ -239,27 +238,9 @@ fsdev_getfspath(struct _reent *r,
fsdev_fsdevice **device, fsdev_fsdevice **device,
char *outpath) char *outpath)
{ {
//ssize_t units;
if(fsdev_fixpath(r, path, device) == NULL) if(fsdev_fixpath(r, path, device) == NULL)
return -1; return -1;
//TODO: What encoding does FS paths use?
/*units = utf8_to_utf16(__utf16path, (const uint8_t*)__fixedpath, PATH_MAX);
if(units < 0)
{
r->_errno = EILSEQ;
return fspath;
}
if(units >= PATH_MAX)
{
r->_errno = ENAMETOOLONG;
return fspath;
}
__utf16path[units] = 0;*/
memset(outpath, 0, FS_MAX_PATH); memset(outpath, 0, FS_MAX_PATH);
strncpy(outpath, __fixedpath, FS_MAX_PATH); strncpy(outpath, __fixedpath, FS_MAX_PATH);
@ -268,8 +249,6 @@ fsdev_getfspath(struct _reent *r,
static ssize_t fsdev_convertfromfspath(uint8_t *out, uint8_t *in, size_t len) static ssize_t fsdev_convertfromfspath(uint8_t *out, uint8_t *in, size_t len)
{ {
//TODO: What encoding does FS paths use?
strncpy((char*)out, (char*)in, len); strncpy((char*)out, (char*)in, len);
return strnlen((char*)out, len); return strnlen((char*)out, len);
} }
@ -349,7 +328,7 @@ static int _fsdevUnmountDeviceStruct(fsdev_fsdevice *device)
memset(name, 0, sizeof(name)); memset(name, 0, sizeof(name));
strncpy(name, device->name, sizeof(name)-2); strncpy(name, device->name, sizeof(name)-2);
strncat(name, ":", sizeof(name)-1); strncat(name, ":", sizeof(name)-strlen(name)-1);
RemoveDevice(name); RemoveDevice(name);
fsFsClose(&device->fs); fsFsClose(&device->fs);