diff options
| author | Junwha <qbit@unist.ac.kr> | 2024-01-03 02:25:28 +0900 |
|---|---|---|
| committer | Damien George <damien@micropython.org> | 2024-07-23 12:13:49 +1000 |
| commit | 29943546343c92334e8518695a11fc0e2ceea68b (patch) | |
| tree | e0ac21a96a80c1481929c5dd0431eeece29e79c2 | |
| parent | 390390ec37d01c3f0ae0af7c489d36ac1e84fbe1 (diff) | |
extmod/vfs: Fix buffer overflow of string comparison in umount.
The comparison between the given unmount string and existing mount strings
were made by the given string, which leads to buffer overflow.
Fixes issue #13006.
Signed-off-by: Junwha <qbit@unist.ac.kr>
| -rw-r--r-- | extmod/vfs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/extmod/vfs.c b/extmod/vfs.c index 5d564459c..e545c9af9 100644 --- a/extmod/vfs.c +++ b/extmod/vfs.c @@ -273,7 +273,7 @@ mp_obj_t mp_vfs_umount(mp_obj_t mnt_in) { mnt_str = mp_obj_str_get_data(mnt_in, &mnt_len); } for (mp_vfs_mount_t **vfsp = &MP_STATE_VM(vfs_mount_table); *vfsp != NULL; vfsp = &(*vfsp)->next) { - if ((mnt_str != NULL && !memcmp(mnt_str, (*vfsp)->str, mnt_len + 1)) || (*vfsp)->obj == mnt_in) { + if ((mnt_str != NULL && mnt_len == (*vfsp)->len && !memcmp(mnt_str, (*vfsp)->str, mnt_len)) || (*vfsp)->obj == mnt_in) { vfs = *vfsp; *vfsp = (*vfsp)->next; break; |