devs/foxbox
1
0
Fork 0
forked from len0rd/rockbox
Code Pull requests Activity

[coverity] fat.c fatlong_parse_entry() buffer overrun, fix warning basisname

Browse source 
BYTES2INT16() uses [i + 0] and [i + 1] therefore 30 is the max element
available in the raw byte array of size 32

 (((uint32_t)array[pos+0] << 0) | \
 ((uint32_t)array[pos+1] << 8))

 struct /* raw byte array */
 {
     uint8_t  data[32];
 };

 basisname is only uninitialized in the . and .. dir entries
both are likely false positives but cheap enough to guard against

Change-Id: Iab3d186fed6050d2d61185071765a2c0feb9515f
This commit is contained in:
William Wilgus 2024-06-05 01:03:13 -04:00 • committed by William Wilgus
parent 74552d5404
commit e54dedd8df
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
firmware/drivers/fat.c
View file

@ -659,11 +659,14 @@ static inline unsigned int longent_char_next(unsigned int i)
{ {
switch (i += 2) switch (i += 2)
{ {
/* flip endian for elements 14 - 27 */
case 26: i -= 1; /* return 28 */ case 26: i -= 1; /* return 28 */
/* Fall-Through */
case 11: i += 3; /* return 14 */ case 11: i += 3; /* return 14 */
} }
/* BYTES2INT16() uses [i + 0] and [i + 1] therefore
return i < 32 ? i : 0; * 30 is the max element available in the raw byte array of size 32 */
return i < 31 ? i : 0;
} }
/* initialize the parse state; call before parsing first long entry */ /* initialize the parse state; call before parsing first long entry */
@ -1708,6 +1711,7 @@ static int add_dir_entry(struct bpb *fat_bpb, struct fat_filestr *parentstr,
int dots = strlcpy(shortname, name, 11); int dots = strlcpy(shortname, name, 11);
memset(&shortname[dots], ' ', 11 - dots); memset(&shortname[dots], ' ', 11 - dots);
entries_needed = 1; entries_needed = 1;
basisname[0] = '\0';
} }
else else
{ {