diff options
| author | Shell <[email protected]> | 2023-10-25 14:45:54 +0800 |
|---|---|---|
| committer | guo <[email protected]> | 2023-10-25 18:40:44 +0800 |
| commit | e94b759160693f8735becb1b0297a9a7a6b90012 (patch) | |
| tree | c75e18481cc042a960e06415ee4f41c817c25211 | |
| parent | 96edf7aeb6911afc64b5eea47cac9936b16a8db1 (diff) | |
[quality] fixup: vulnerability in kernel
including out-of-bound access in dfs, and use-after-free in
aspace_traversal
Signed-off-by: Shell <[email protected]>
| -rw-r--r-- | components/dfs/dfs_v1/src/dfs.c | 2 | ||||
| -rw-r--r-- | components/dfs/dfs_v2/src/dfs.c | 2 | ||||
| -rw-r--r-- | components/mm/mm_aspace.c | 10 |
3 files changed, 8 insertions, 6 deletions
diff --git a/components/dfs/dfs_v1/src/dfs.c b/components/dfs/dfs_v1/src/dfs.c index 51040ca0b5..94bd8385cd 100644 --- a/components/dfs/dfs_v1/src/dfs.c +++ b/components/dfs/dfs_v1/src/dfs.c @@ -759,7 +759,7 @@ up_one: /* remove '/' in the end of path if exist */ dst--; - if ((dst != fullpath) && (*dst == '/')) + if (dst >= fullpath && (dst != fullpath) && (*dst == '/')) *dst = '\0'; /* final check fullpath is not empty, for the special path of lwext "/.." */ diff --git a/components/dfs/dfs_v2/src/dfs.c b/components/dfs/dfs_v2/src/dfs.c index bcea75e219..62e5805d7a 100644 --- a/components/dfs/dfs_v2/src/dfs.c +++ b/components/dfs/dfs_v2/src/dfs.c @@ -668,7 +668,7 @@ char *dfs_normalize_path(const char *directory, const char *filename) /* remove '/' in the end of path if exist */ dst--; - if ((dst != fullpath) && (*dst == '/')) + if (dst >= fullpath && (dst != fullpath) && (*dst == '/')) *dst = '\0'; /* final check fullpath is not empty, for the special path of lwext "/.." */ diff --git a/components/mm/mm_aspace.c b/components/mm/mm_aspace.c index 76a50a67b1..df30b5460c 100644 --- a/components/mm/mm_aspace.c +++ b/components/mm/mm_aspace.c @@ -345,10 +345,10 @@ rt_inline rt_err_t _migrate_and_release_varea(rt_aspace_t aspace, rt_varea_t to, { /* uninstall operand & release the varea */ _aspace_bst_remove(aspace, from); - if (!(from->flag & MMF_STATIC_ALLOC)) - rt_free(from); - to->size += from->size; + + if (VAREA_NOT_STATIC(from)) + rt_free(from); } return error; } @@ -1377,12 +1377,14 @@ int rt_aspace_traversal(rt_aspace_t aspace, int (*fn)(rt_varea_t varea, void *arg), void *arg) { rt_varea_t varea; + rt_varea_t next; WR_LOCK(aspace); varea = ASPACE_VAREA_FIRST(aspace); while (varea) { + next = ASPACE_VAREA_NEXT(varea); fn(varea, arg); - varea = ASPACE_VAREA_NEXT(varea); + varea = next; } WR_UNLOCK(aspace); |