Skip to content

Commit 92c92ee

Browse files
committed
components: libc: fix array overflow in rt_object name assignment
[Problem Description] When assigning name to rt_object, strncpy() uses size equal to RT_NAME_MAX, which causes missing null-terminator and overflows into adjacent 'type' field. This corruption leads to unexpected system behavior. [Problem Analysis] The rt_object structure defines: | char name[RT_NAME_MAX] | -> buffer | rt_uint8_t type | -> adjacent field Original code calculates size as: size = end - first + 1; if (size > RT_NAME_MAX) size = RT_NAME_MAX; When size equals RT_NAME_MAX, strncpy() will copy exactly RT_NAME_MAX bytes without adding terminating '\0', causing two issues: 1. name buffer is not null-terminated 2. The implicit null-byte writes beyond name[] into type field [Solution] Change boundary check from: if (size > RT_NAME_MAX) size = RT_NAME_MAX; to: if (size >= RT_NAME_MAX) size = RT_NAME_MAX - 1; This ensures: 1. Always leaves space for null-terminator 2. Prevents overflow into type field 3. Maintains maximum valid name length (RT_NAME_MAX-1 + '\0') Signed-off-by: Liu Gui <[email protected]>
1 parent ea31985 commit 92c92ee

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

components/libc/posix/libdl/dlmodule.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ static void _dlmodule_set_name(struct rt_dlmodule *module, const char *path)
5555
}
5656

5757
size = end - first + 1;
58-
if (size > RT_NAME_MAX) size = RT_NAME_MAX;
58+
if (size >= RT_NAME_MAX) size = RT_NAME_MAX - 1;
5959

6060
rt_strncpy(object->name, first, size);
6161
object->name[size] = '\0';

0 commit comments

Comments
 (0)