Skip to content

Commit

Permalink
components: libc: fix array overflow in rt_object name assignment
Browse files Browse the repository at this point in the history
[Problem Description]
When assigning name to rt_object, strncpy() uses size equal to RT_NAME_MAX,
which causes missing null-terminator and overflows into adjacent 'type' field.
This corruption leads to unexpected system behavior.

[Problem Analysis]
The rt_object structure defines:
| char name[RT_NAME_MAX] | -> buffer
| rt_uint8_t type        | -> adjacent field

Original code calculates size as:
size = end - first + 1;
if (size > RT_NAME_MAX) size = RT_NAME_MAX;

When size equals RT_NAME_MAX, strncpy() will copy exactly RT_NAME_MAX bytes
without adding terminating '\0', causing two issues:
1. name buffer is not null-terminated
2. The implicit null-byte writes beyond name[] into type field

[Solution]
Change boundary check from:
if (size > RT_NAME_MAX) size = RT_NAME_MAX;
to:
if (size >= RT_NAME_MAX) size = RT_NAME_MAX - 1;

This ensures:
1. Always leaves space for null-terminator
2. Prevents overflow into type field
3. Maintains maximum valid name length (RT_NAME_MAX-1 + '\0')

Signed-off-by: Liu Gui <kenneth.liu@sophgo.com>
  • Loading branch information
KennethLiu61 authored and mysterywolf committed Feb 21, 2025
1 parent 2e332d3 commit a5b26bb
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion components/libc/posix/libdl/dlmodule.c
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ static void _dlmodule_set_name(struct rt_dlmodule *module, const char *path)
}

size = end - first + 1;
if (size > RT_NAME_MAX) size = RT_NAME_MAX;
if (size >= RT_NAME_MAX) size = RT_NAME_MAX - 1;

rt_strncpy(object->name, first, size);
object->name[size] = '\0';
Expand Down

0 comments on commit a5b26bb

Please sign in to comment.