devs/foxbox
1
0
Fork 0
forked from len0rd/rockbox
Code Pull requests Activity

[bugfix] tree.c rockbox_browse dirfilter use after free, set_current_file_ex

Browse source 
rockbox_browse() set its own *dirfilter and then may neglect to restore it

set_current_file_ex()
can take a unified path and file or separate path and file

only issue is when you send a folder and don't have the final slash
its then interpreted as a file and current file is set to it
meanwhile path is split and you end up in the parent dir

instead if filename is null check if path points to a directory
if dir_exists(path) then we will use it as is and set filename to ""

Change-Id: I6beaa91141c1a4025cdfac5d6ba426137146c212
This commit is contained in:
William Wilgus 2025-01-21 22:01:16 -05:00 • committed by William Wilgus
parent 3c9233e972
commit f3a858e16c
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
apps/tree.c
View file

@ -609,7 +609,7 @@ static void set_current_file_ex(const char *path, const char *filename)
return; return;
#endif #endif
if (!filename) /* path and filename supplied combined */ if (!filename && !dir_exists(path)) /* path and filename supplied combined */
{ {
/* separate directory from filename */ /* separate directory from filename */
/* gets the directory's name and put it into tc.currdir */ /* gets the directory's name and put it into tc.currdir */
@ -628,6 +628,8 @@ static void set_current_file_ex(const char *path, const char *filename)
} }
else /* path and filename came in separate ensure an ending '/' */ else /* path and filename came in separate ensure an ending '/' */
{ {
if (!filename)
filename = "";
char *end_p = strmemccpy(tc.currdir, path, MAX_PATH); char *end_p = strmemccpy(tc.currdir, path, MAX_PATH);
size_t endpos = end_p - tc.currdir; size_t endpos = end_p - tc.currdir;
if (endpos < MAX_PATH) if (endpos < MAX_PATH)
@ -1053,7 +1055,7 @@ int rockbox_browse(struct browse_context *browse)
if (backup_count >= 0) if (backup_count >= 0)
backups[backup_count] = tc; backups[backup_count] = tc;
backup_count++; backup_count++;
int *prev_dirfilter = tc.dirfilter;
tc.dirfilter = &dirfilter; tc.dirfilter = &dirfilter;
tc.sort_dir = global_settings.sort_dir; tc.sort_dir = global_settings.sort_dir;
@ -1110,6 +1112,7 @@ int rockbox_browse(struct browse_context *browse)
} }
tc.is_browsing = false; tc.is_browsing = false;
tc.dirfilter = prev_dirfilter; /* Bugfix restore dirfilter*/
backup_count--; backup_count--;
if (backup_count >= 0) if (backup_count >= 0)