Skip to content

fs: fix use-after-scope of alloca path buffers (CONFIG_LIBC_TEMPBUFFER=n) #20118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
JianyuWang0623 wants to merge 2 commits into from
+8 −6
Closed

fs: fix use-after-scope of alloca path buffers (CONFIG_LIBC_TEMPBUFFER=n) #20118

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fab447c
fs/inode: fix use-after-scope of search path buffer under alloca
JianyuWang0623 Sep 11, 2026
a33f163
libc: fix use-after-scope of path buffers under alloca
JianyuWang0623 Sep 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions fs/inode/fs_inodesearch.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -429,7 +429,7 @@ static int _inode_search(FAR struct inode_search_s *desc)
buflen = PATH_MAX;
}

desc->buffer = lib_get_tempbuffer(buflen);
desc->buffer = fs_heap_malloc(buflen);
if (desc->buffer == NULL)
{
return -ENOMEM;
Expand Down Expand Up @@ -578,7 +578,7 @@ static int _inode_search(FAR struct inode_search_s *desc)
{
FAR char *buffer = NULL;

buffer = lib_get_tempbuffer(PATH_MAX);
buffer = fs_heap_malloc(PATH_MAX);
if (buffer == NULL)
{
ret = -ENOMEM;
Expand All @@ -587,7 +587,7 @@ static int _inode_search(FAR struct inode_search_s *desc)
{
snprintf(buffer, PATH_MAX, "%s/%s",
desc->relpath, name);
lib_put_tempbuffer(desc->buffer);
fs_heap_free(desc->buffer);
desc->buffer = buffer;
relpath = buffer;
ret = OK;
Expand Down
4 changes: 3 additions & 1 deletion fs/inode/inode.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,8 @@
#include <nuttx/fs/fs.h>
#include <nuttx/lib/lib.h>

#include "fs_heap.h"

/****************************************************************************
* Pre-processor Definitions
****************************************************************************/
Expand All @@ -63,7 +65,7 @@
{ \
if ((d)->buffer != NULL) \
{ \
lib_put_tempbuffer((d)->buffer); \
fs_heap_free((d)->buffer); \
(d)->buffer = NULL; \
} \
} \
Expand Down
4 changes: 2 additions & 2 deletions include/nuttx/lib/lib.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,8 +130,8 @@ void lib_put_tempbuffer(FAR char *buffer);
# define lib_put_tempbuffer(b)
#endif

#define lib_get_pathbuffer() lib_get_tempbuffer(PATH_MAX)
#define lib_put_pathbuffer(b) lib_put_tempbuffer(b)
#define lib_get_pathbuffer() lib_malloc(PATH_MAX)
#define lib_put_pathbuffer(b) lib_free(b)

/* Functions defined in lib_realpath.c **************************************/

Expand Down
Loading