Fixed buffer overflow due to mistaking prog_size for cache_size

found by ajaybhargav
Merge pull request #151 from Krakonos/master
2025-11-01 08:48:31 +01:00 · 2019-04-12 08:44:00 -05:00 · 2019-04-12 17:07:25 -05:00 · 2019-04-12 17:06:58 -05:00 · 2019-04-12 15:09:44 -05:00 · 2019-03-01 10:01:02 +01:00
2 changed files with 7 additions and 2 deletions
--- a/lfs.c
+++ b/lfs.c
@@ -29,7 +29,7 @@ static inline void lfs_cache_drop(lfs_t *lfs, lfs_cache_t *rcache) {

 static inline void lfs_cache_zero(lfs_t *lfs, lfs_cache_t *pcache) {
    // zero to avoid information leak
-    memset(pcache->buffer, 0xff, lfs->cfg->prog_size);
+    memset(pcache->buffer, 0xff, lfs->cfg->cache_size);
    pcache->block = 0xffffffff;
 }

@@ -2864,6 +2864,10 @@ int lfs_file_truncate(lfs_t *lfs, lfs_file_t *file, lfs_off_t size) {
        return LFS_ERR_BADF;
    }

+    if (size > LFS_FILE_MAX) {
+        return LFS_ERR_INVAL;
+    }
+
    lfs_off_t oldsize = lfs_file_size(lfs, file);
    if (size < oldsize) {
        // need to flush since directly changing metadata
--- a/lfs.h
+++ b/lfs.h
@@ -578,7 +578,8 @@ int lfs_dir_close(lfs_t *lfs, lfs_dir_t *dir);
 // Read an entry in the directory
 //
 // Fills out the info structure, based on the specified file or directory.
-// Returns a negative error code on failure.
+// Returns a positive value on success, 0 at the end of directory,
+// or a negative error code on failure.
 int lfs_dir_read(lfs_t *lfs, lfs_dir_t *dir, struct lfs_info *info);

 // Change the position of the directory
Author	SHA1	Message	Date
Christopher Haster	780ef2fce4	Fixed buffer overflow due to mistaking prog_size for cache_size found by ajaybhargav	2019-04-12 08:44:00 -05:00
Christopher Haster	73ea008b74	Merge pull request #151 from Krakonos/master Fixed documentation for return lfs_dir_read return value.	2019-04-12 17:07:25 -05:00
Christopher Haster	c849748453	Merge pull request #150 from ajaybhargav/truncate-fix Fix: length more than LFS_FILE_MAX should return error	2019-04-12 17:06:58 -05:00
Ajay Bhargav	905727b684	Fix: length more than LFS_FILE_MAX should return error To make lfs_file_truncate inline with ftruncate function, when -ve or size more than maximum file size is passed to function it should return invalid parameter error. In LFS case LFS_ERR_INVAL. Signed-off-by: Ajay Bhargav <contact@rickeyworld.info>	2019-04-12 15:09:44 -05:00
Ladislav Láska	26d25608b6	Fixed documentation for return lfs_dir_read return value. lfs_dir_read breaks the convention of returning non-zero on success, this feature should be at least documented.	2019-03-01 10:01:02 +01:00