rt-thread.git/components/libc/posix, branch v5.2.0-beta

fix dangling pointer in component pthread and dfs_elm (#9976)

2025-03-17T08:39:43Z

* [components/libc/posix][pthreads]fix the risk of dangling pointer * [components][dfs][dfs_elm]:fix risk of dangling pointer, unmount the temp driver then free the temp FATFS in dfs_elm_mkfs.

components: libc: fix pointer-to-integer cast warnings and address truncation

2025-03-10T14:44:18Z

[Problem Description] 1. When enabling RT_USING_MODULE=y, compilation warnings occur: dlelf.c:386:27: warning: cast from pointer to integer of different size dlelf.c:398:25: warning: cast from pointer to integer of different size dlelf.c:408:24: warning: cast from pointer to integer of different size 2. On RV64 architectures (e.g. Sophgo SG2042 with RISC-V Sv39 and 40-bit physical addressing), dlsym may fail when accessing addresses beyond 32-bit range. [Root Cause] In dlmodule_load_relocated_object() and dlmodule_symbol_find(), pointer is cast to rt_uint32_t which truncates: | rt_ubase_t rodata_addr = (rt_uint32_t)ptr; This causes: - Warnings on 64-bit systems (pointer width > 32-bit) - Actual address truncation on RV64 when physical address exceeds 32-bit [Solution] Replace rt_uint32_t with architecture-adaptive rt_ubase_t: | rt_ubase_t rodata_addr = (rt_ubase_t)ptr; The rt_ubase_t is defined in include/rttypes.h as: | #ifdef ARCH_CPU_64BIT | typedef rt_uint64_t rt_ubase_t; | #else | typedef rt_uint32_t rt_ubase_t; | #endif This ensures correct width casting for both 32/64-bit architectures. Signed-off-by: Liu Gui

components: libc: fix array overflow in rt_object name assignment

2025-03-10T14:43:06Z

[Problem Description] When assigning name to rt_object, strncpy() uses size equal to RT_NAME_MAX, which causes missing null-terminator and overflows into adjacent 'type' field. This corruption leads to unexpected system behavior. [Problem Analysis] The rt_object structure defines: | char name[RT_NAME_MAX] | -> buffer | rt_uint8_t type | -> adjacent field Original code calculates size as: size = end - first + 1; if (size > RT_NAME_MAX) size = RT_NAME_MAX; When size equals RT_NAME_MAX, strncpy() will copy exactly RT_NAME_MAX bytes without adding terminating '\0', causing two issues: 1. name buffer is not null-terminated 2. The implicit null-byte writes beyond name[] into type field [Solution] Change boundary check from: if (size > RT_NAME_MAX) size = RT_NAME_MAX; to: if (size >= RT_NAME_MAX) size = RT_NAME_MAX - 1; This ensures: 1. Always leaves space for null-terminator 2. Prevents overflow into type field 3. Maintains maximum valid name length (RT_NAME_MAX-1 + '\0') Signed-off-by: Liu Gui

[components][libc/io]add comments for timer fd APIs.

2024-12-19T02:07:42Z

[components/libc/posix]add comments for thread local storage APIs.

2024-11-22T02:46:47Z

[components/libc/posix]fix the problem that it doesn't check if barrier still in use and dosen't destory the mutex either.

2024-11-22T00:22:44Z

[components/libc/posix]fix the errors that assigning an integer to a pointer and always return EINVAL.

2024-11-22T00:22:44Z

[components/libc/posix]add comments for barrier APIs.

2024-11-22T00:22:44Z

[components/libc/posix]add comments for rwlock APIs.

2024-11-19T23:26:16Z

[components/libc/posix]add comments for condition variable APIs.

2024-11-19T23:26:16Z