From 083e4e7f96ddf15d87c17ef6f54c79a506ec53aa Mon Sep 17 00:00:00 2001 From: angryproton Date: Sun, 23 Aug 2026 19:14:01 +0800 Subject: [PATCH] =?UTF-8?q?[FIX][DFS]=E5=8F=82=E8=80=83V1=E7=89=88?= =?UTF-8?q?=E6=9C=AC=EF=BC=8C=E4=BF=AE=E5=A4=8DV2=E7=89=88=E6=9C=AC?= =?UTF-8?q?=E7=9A=84ramfs=E4=B8=8Etmpfs=E8=B7=AF=E5=BE=84=E5=90=8D?= =?UTF-8?q?=E5=A4=84=E7=90=86=E8=BE=B9=E7=95=8C=E9=97=AE=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../dfs/dfs_v2/filesystems/ramfs/dfs_ramfs.c | 65 ++++++++++++++++--- .../dfs/dfs_v2/filesystems/tmpfs/dfs_tmpfs.c | 63 ++++++++++++++---- 2 files changed, 109 insertions(+), 19 deletions(-) diff --git a/components/dfs/dfs_v2/filesystems/ramfs/dfs_ramfs.c b/components/dfs/dfs_v2/filesystems/ramfs/dfs_ramfs.c index fd7326bd0184..5e24a9f97035 100644 --- a/components/dfs/dfs_v2/filesystems/ramfs/dfs_ramfs.c +++ b/components/dfs/dfs_v2/filesystems/ramfs/dfs_ramfs.c @@ -59,6 +59,51 @@ int dfs_ramfs_ioctl(struct dfs_file *file, int cmd, void *args) return -EIO; } +static int _ramfs_set_name(char *name, rt_size_t name_size, const char *path) +{ + const char *name_ptr = path; + const char *name_scan; + rt_size_t name_len; + + if (path == RT_NULL) + { + return -EINVAL; + } + + /* strip leading '/' */ + while (*name_ptr == '/' && *name_ptr) + { + name_ptr++; + } + + if (*name_ptr == '\0') + { + return -ENOENT; + } + + /* reject multi-level paths (ramfs is flat) */ + name_scan = name_ptr; + while (*name_scan) + { + if (*name_scan == '/') + { + return -EINVAL; + } + name_scan++; + } + + name_len = rt_strlen(name_ptr); + if (name_len >= name_size) + { + return -ENAMETOOLONG; + } + + rt_memcpy(name, name_ptr, name_len); + name[name_len] = '\0'; + + return RT_EOK; +} + struct ramfs_dirent *dfs_ramfs_lookup(struct dfs_ramfs *ramfs, const char *path, rt_size_t *size) @@ -232,7 +277,7 @@ int dfs_ramfs_open(struct dfs_file *file) { if (file->flags & O_CREAT || file->flags & O_WRONLY) { - char *name_ptr; + int ret; /* create a file entry */ dirent = (struct ramfs_dirent *) @@ -243,13 +288,12 @@ int dfs_ramfs_open(struct dfs_file *file) return -ENOMEM; } - /* remove '/' separator */ - name_ptr = file->vnode->path; - while (*name_ptr == '/' && *name_ptr) + ret = _ramfs_set_name(dirent->name, sizeof(dirent->name), file->vnode->path); + if (ret != RT_EOK) { - name_ptr++; + rt_memheap_free(dirent); + return ret; } - strncpy(dirent->name, name_ptr, RAMFS_NAME_MAX); rt_list_init(&(dirent->list)); dirent->data = NULL; @@ -390,6 +434,7 @@ int dfs_ramfs_rename(struct dfs_filesystem *fs, struct ramfs_dirent *dirent; struct dfs_ramfs *ramfs; rt_size_t size; + int ret; ramfs = (struct dfs_ramfs *)fs->data; RT_ASSERT(ramfs != NULL); @@ -402,7 +447,11 @@ int dfs_ramfs_rename(struct dfs_filesystem *fs, if (dirent == NULL) return -ENOENT; - strncpy(dirent->name, newpath, RAMFS_NAME_MAX); + ret = _ramfs_set_name(dirent->name, sizeof(dirent->name), newpath); + if (ret != RT_EOK) + { + return ret; + } return RT_EOK; } @@ -471,7 +520,7 @@ struct dfs_ramfs *dfs_ramfs_create(rt_uint8_t *pool, rt_size_t size) rt_memset(&(ramfs->root), 0x00, sizeof(ramfs->root)); rt_list_init(&(ramfs->root.list)); ramfs->root.size = 0; - strcpy(ramfs->root.name, "."); + rt_strcpy(ramfs->root.name, "."); ramfs->root.fs = ramfs; return ramfs; diff --git a/components/dfs/dfs_v2/filesystems/tmpfs/dfs_tmpfs.c b/components/dfs/dfs_v2/filesystems/tmpfs/dfs_tmpfs.c index 1dc1fd54f9ea..ea6df2c8d01d 100644 --- a/components/dfs/dfs_v2/filesystems/tmpfs/dfs_tmpfs.c +++ b/components/dfs/dfs_v2/filesystems/tmpfs/dfs_tmpfs.c @@ -43,13 +43,16 @@ static struct dfs_aspace_ops dfs_tmp_aspace_ops = }; #endif -static int _path_separate(const char *path, char *parent_path, char *file_name) +static int _path_separate(const char *path, char *parent_path, rt_size_t parent_size, + char *file_name, rt_size_t file_size) { const char *path_p, *path_q; + rt_size_t parent_len, file_len; RT_ASSERT(path[0] == '/'); file_name[0] = '\0'; + parent_path[0] = '\0'; path_p = path_q = &path[1]; __next_dir: while (*path_q != '/' && *path_q != '\0') @@ -66,10 +69,18 @@ static int _path_separate(const char *path, char *parent_path, char *file_name) } else /* Last level dir */ { - rt_memcpy(parent_path, path, path_p - path - 1); - parent_path[path_p - path - 1] = '\0'; - rt_memcpy(file_name, path_p, path_q - path_p); - file_name[path_q - path_p] = '\0'; + parent_len = path_p - path - 1; + file_len = path_q - path_p; + + if ((parent_len + 1 > parent_size) || (file_len + 1 > file_size)) + { + return -ENAMETOOLONG; + } + + rt_memcpy(parent_path, path, parent_len); + parent_path[parent_len] = '\0'; + rt_memcpy(file_name, path_p, file_len); + file_name[file_len] = '\0'; } } if (parent_path[0] == 0) @@ -83,17 +94,31 @@ static int _path_separate(const char *path, char *parent_path, char *file_name) return 0; } -static int _get_subdir(const char *path, char *name) +static int _get_subdir(const char *path, char *name, rt_size_t name_size) { const char *subpath = path; + rt_size_t len = 0; + + if (name_size == 0) + { + return -EINVAL; + } + while (*subpath == '/' && *subpath) subpath ++; while (*subpath != '/' && *subpath) { + if (len + 1 >= name_size) + { + name[0] = '\0'; + return -ENAMETOOLONG; + } *name = *subpath; name ++; subpath ++; + len ++; } + *name = '\0'; return 0; } @@ -256,7 +281,10 @@ struct tmpfs_file *dfs_tmpfs_lookup(struct tmpfs_sb *superblock, subpath ++; /* skip '/' */ memset(subdir_name, 0, TMPFS_NAME_MAX); - _get_subdir(curpath, subdir_name); + if (_get_subdir(curpath, subdir_name, sizeof(subdir_name)) != 0) + { + return RT_NULL; + } rt_spin_lock(&superblock->lock); @@ -612,7 +640,12 @@ static int dfs_tmpfs_rename(struct dfs_dentry *old_dentry, struct dfs_dentry *ne } /* find parent file */ - _path_separate(new_dentry->pathname, parent_path, file_name); + if (_path_separate(new_dentry->pathname, parent_path, DFS_PATH_MAX, + file_name, sizeof(file_name)) != RT_EOK) + { + rt_free(parent_path); + return -ENAMETOOLONG; + } if (file_name[0] == '\0') /* it's root dir */ { rt_free(parent_path); @@ -626,7 +659,8 @@ static int dfs_tmpfs_rename(struct dfs_dentry *old_dentry, struct dfs_dentry *ne dfs_vfs_remove_node(&d_file->node); rt_spin_unlock(&superblock->lock); - strncpy(d_file->name, file_name, TMPFS_NAME_MAX); + rt_strncpy(d_file->name, file_name, TMPFS_NAME_MAX); + d_file->name[TMPFS_NAME_MAX - 1] = '\0'; rt_spin_lock(&superblock->lock); dfs_vfs_append_node(&p_file->node, &d_file->node); @@ -707,7 +741,13 @@ static struct dfs_vnode *dfs_tmpfs_create_vnode(struct dfs_dentry *dentry, int t if (vnode) { /* find parent file */ - _path_separate(dentry->pathname, parent_path, file_name); + if (_path_separate(dentry->pathname, parent_path, DFS_PATH_MAX, + file_name, sizeof(file_name)) != RT_EOK) + { + rt_free(parent_path); + dfs_vnode_destroy(vnode); + return NULL; + } if (file_name[0] == '\0') /* it's root dir */ { rt_free(parent_path); @@ -735,7 +775,8 @@ static struct dfs_vnode *dfs_tmpfs_create_vnode(struct dfs_dentry *dentry, int t superblock->df_size += sizeof(struct tmpfs_file); - strncpy(d_file->name, file_name, TMPFS_NAME_MAX); + rt_strncpy(d_file->name, file_name, TMPFS_NAME_MAX); + d_file->name[TMPFS_NAME_MAX - 1] = '\0'; dfs_vfs_init_node(&d_file->node); d_file->data = NULL;