Skip to content

Commit d3b911d

Browse files
FlutterGeneratorgithub-advanced-security[bot]
FlutterGenerator
and
github-advanced-security[bot]
authored
added the Uzbek language я исправил потвердите (#3306)
* added the Uzbek language * Potential fix for code scanning alert no. 1: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 2: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 3: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 13: Time-of-check time-of-use filesystem race condition Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 12: Time-of-check time-of-use filesystem race condition Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 4: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 11: Time-of-check time-of-use filesystem race condition Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 5: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 7: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 14: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 10: Time-of-check time-of-use filesystem race condition Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 15: Time-of-check time-of-use filesystem race condition Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 9: Call to `memset` may be deleted Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Update bootstrap.js * Update ci.yml * Potential fix for code scanning alert no. 17: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 16: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Update ci.yml * Update ci.yml --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
1 parent 5c6e1c2 commit d3b911d

File tree

9 files changed

+177
-66
lines changed

9 files changed

+177
-66
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
name: Ventoy CI
2+
permissions:
3+
contents: read
24

35
on:
46
push:
@@ -12,26 +14,26 @@ jobs:
1214
build:
1315
runs-on: ubuntu-latest
1416
steps:
15-
- uses: actions/checkout@v3
17+
- uses: actions/checkout@v6
1618
- name: Run docker compose up
1719
run: docker compose up
18-
- uses: actions/upload-artifact@v4
20+
- uses: actions/upload-artifact@v6
1921
with:
2022
name: ventoy-windows
2123
path: INSTALL/ventoy-*windows*
22-
- uses: actions/upload-artifact@v4
24+
- uses: actions/upload-artifact@v6
2325
with:
2426
name: ventoy-linux
2527
path: INSTALL/ventoy-*linux*
26-
- uses: actions/upload-artifact@v4
28+
- uses: actions/upload-artifact@v6
2729
with:
2830
name: ventoy-livecd
2931
path: INSTALL/ventoy-*livecd*
30-
- uses: actions/upload-artifact@v4
32+
- uses: actions/upload-artifact@v6
3133
with:
3234
name: SHA256SUM
3335
path: INSTALL/sha256.txt
34-
- uses: actions/upload-artifact@v4
36+
- uses: actions/upload-artifact@v6
3537
with:
3638
name: xxx-build-log
3739
path: DOC/build.log

‎.github/workflows/sync2gitee.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
name: Mirror GitHub to Gitee
2+
permissions:
3+
contents: read
24

35
on:
46
# Triggers the workflow on push or pull request events but only for the main branch

‎LANGUAGES/languages.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2728,6 +2728,71 @@
27282728

27292729
"STRXXX":""
27302730
},
2731+
{
2732+
"name":"Uzbek (Uzbek tili)",
2733+
"FontFamily":"Courier New",
2734+
"FontSize":16,
2735+
"Author":"Husen Djalolov, tojik_proof_93",
2736+
2737+
"STR_ERROR":"Xato",
2738+
"STR_WARNING":"Diqqat",
2739+
"STR_INFO":"Ma'lumot",
2740+
"STR_INCORRECT_DIR":"Boshqa papkada ishga tushiring!",
2741+
"STR_INCORRECT_TREE_DIR":"Ilovani bu erda ishga tushirmang, o'rnatish paketini yuklab oling va uni boshqa joyda ishga tushiring.",
2742+
"STR_DEVICE":"Qurilma",
2743+
"STR_LOCAL_VER":"Paketdagi Ventoy",
2744+
"STR_DISK_VER":"Drayvdagi Ventoy",
2745+
"STR_STATUS":"Davlat-tayyor",
2746+
"STR_INSTALL":"O'rnatish",
2747+
"STR_UPDATE":"Yangilash",
2748+
"STR_UPDATE_TIP":"Yangilash xavfsiz, ISO tasvirlari o'zgarishsiz qoladi.#@Davom etasizmi?",
2749+
"STR_INSTALL_TIP":"Ushbu amal drayverni formatlaydi va undagi barcha ma'lumotlar o'chib ketadi.#@Davom etasizmi?",
2750+
"STR_INSTALL_TIP2":"Ushbu harakat drayverni formatlaydi, undagi barcha ma'lumotlar yo'q qilinadi.#@Siz haqiqatan ham davom etishni xohlaysizmi?",
2751+
"STR_INSTALL_SUCCESS":"Tabriklaymiz!#@Ventoy-ni qurilmaga o'rnatish muvaffaqiyatli amalga oshirildi.",
2752+
"STR_INSTALL_FAILED":"O'rnatish xatosi. USB drayverini qayta ulang va qaytadan urinib ko'ring. Log fayliga qarang.tafsilotlar bilan txt. Agar xato davom etsa, rasmiy veb-saytdagi «FAQ» ga qarang.",
2753+
"STR_UPDATE_SUCCESS":"Tabriklaymiz!#@Ventoy qurilmangizda muvaffaqiyatli yangilandi.",
2754+
"STR_UPDATE_FAILED":"Ventoy-ni yangilashda xato. USB drayverini qayta ulang va qaytadan urinib ko'ring. Log fayliga qarang.tafsilotlar bilan txt. Agar xato davom etsa, rasmiy veb-saytdagi «FAQ» ga qarang.",
2755+
"STR_WAIT_PROCESS":"Harakat boshlandi, kuting...",
2756+
"STR_MENU_OPTION":"Sozlamalar",
2757+
"STR_MENU_SECURE_BOOT":"Secure Boot-Ni Qo'llab-Quvvatlash",
2758+
"STR_MENU_PART_CFG":"Qo'shimcha bo'lim",
2759+
"STR_BTN_OK":"OK",
2760+
"STR_BTN_CANCEL":"Bekor qilish",
2761+
"STR_PRESERVE_SPACE":"Disk oxirida qo'shimcha bo'lim yarating",
2762+
"STR_SPACE_VAL_INVALID":"Bo'lim o'lchamining yaroqsiz qiymati",
2763+
"STR_MENU_CLEAR":"Ventoyni Olib Tashlang",
2764+
"STR_CLEAR_SUCCESS":"Ventoy qurilmadan muvaffaqiyatli olib tashlandi.",
2765+
"STR_CLEAR_FAILED":"Ventoyni olib tashlashda xato. USB drayverini qayta ulang va qaytadan urinib ko'ring. Log fayliga qarang.tafsilotlar bilan txt.",
2766+
"STR_MENU_PART_STYLE":"Bo'limlarni belgilash uslubi",
2767+
"STR_DISK_2TB_MBR_ERROR":"2 TB dan ortiq xotira uchun GPT ni tanlang",
2768+
"STR_SHOW_ALL_DEV":"Barcha qurilmalarni ko'rsatish",
2769+
"STR_PART_ALIGN_4KB":"4 KB klasterli bo'limlarni tekislang",
2770+
"STR_WEB_COMMUNICATION_ERR":"Aloqa xatosi:",
2771+
"STR_WEB_REMOTE_ABNORMAL":"Aloqa xatosi: masofaviy ulanish haqiqiy emas",
2772+
"STR_WEB_REQUEST_TIMEOUT":"Aloqa xatosi: so'rov vaqti tugadi",
2773+
"STR_WEB_SERVICE_UNAVAILABLE":"Aloqa xatosi: xizmat mavjud emas",
2774+
"STR_WEB_TOKEN_MISMATCH":"Xizmat holati yangilandi, keyinroq qayta urinib ko'ring.",
2775+
"STR_WEB_SERVICE_BUSY":"Xizmat band, keyinroq qayta urinib ko'ring.",
2776+
"STR_MENU_VTSI_CREATE":"Fayl yarating .vtsi",
2777+
"STR_VTSI_CREATE_TIP":"Ventoy-ni haydovchiga o'rnatish o'rniga faqat vtsi fayli yaratiladi.#@Davom etasizmi?",
2778+
"STR_VTSI_CREATE_SUCCESS":"Fayl .vtsi muvaffaqiyatli yaratildi.#@Ventoy-ni o'rnatishni yakunlash uchun uni Rufus ilovasi (v3.15+) yordamida diskka yozishingiz mumkin.",
2779+
"STR_VTSI_CREATE_FAILED":"Vtsi faylini yaratishda xato.",
2780+
"STR_MENU_PART_RESIZE":"Buzilmaydigan o'rnatish",
2781+
"STR_PART_RESIZE_TIP":"Ventoy buzilmaydigan o'rnatishni amalga oshirishga harakat qiladi.#@Davom etasizmi?",
2782+
"STR_PART_RESIZE_SUCCESS":"Tabriklaymiz!#@Ventoy-ni buzilmaydigan o'rnatish muvaffaqiyatli yakunlandi.",
2783+
"STR_PART_RESIZE_FAILED":"Buzilmaydigan o'rnatishni amalga oshirib bo'lmadi, log fayliga qarang.tafsilotlar bilan txt.",
2784+
"STR_PART_RESIZE_UNSUPPORTED":"Ventoy-ning buzilmaydigan o'rnatilishi ba'zi talablarga javob bermasligi sababli to'xtatildi. Log fayliga qarang.tafsilotlar bilan txt.",
2785+
"STR_INSTALL_YES_TIP1":"DIQQAT: Barcha ma'lumotlar yo'qoladi!",
2786+
"STR_INSTALL_YES_TIP2":"Yangilashni emas, balki yangi o'rnatishni amalga oshirishni xohlayotganingizni tasdiqlash uchun quyidagi matn maydoniga «HA» yozing.",
2787+
"STR_PART_VENTOY_FS":"Ventoy bo'limi uchun fayl tizimi",
2788+
"STR_PART_FS":"Turi:",
2789+
"STR_PART_CLUSTER":"Klaster hajmi:",
2790+
"STR_PART_CLUSTER_DEFAULT":"Standart tizim qiymati",
2791+
"STR_DONATE":"Xayriya qilish",
2792+
"STR_4KN_UNSUPPORTED":"Ventoy hozirda mahalliy 4K qurilmalarini qo'llab-quvvatlamaydi.",
2793+
2794+
"STRXXX":""
2795+
},
27312796
{
27322797
"name":"Greek (Ελληνικά)",
27332798
"FontFamily":"Courier New",

‎LinuxGUI/Ventoy2Disk/Lib/libhttp/include/civetweb.c‎

Lines changed: 22 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -7963,28 +7963,32 @@ delete_file(struct mg_connection *conn, const char *path)
79637963
}
79647964

79657965
/* This is an existing file (not a directory).
7966-
* Check if write permission is granted. */
7967-
if (access(path, W_OK) != 0) {
7968-
/* File is read only */
7969-
send_http_error(
7970-
conn,
7971-
403,
7972-
"Error: Delete not possible\nDeleting %s is not allowed",
7973-
path);
7974-
return;
7975-
}
7976-
7977-
/* Try to delete it. */
7966+
* Try to delete it directly and handle errors. */
79787967
if (mg_remove(conn, path) == 0) {
79797968
/* Delete was successful: Return 204 without content. */
79807969
send_http_error(conn, 204, "%s", "");
79817970
} else {
7982-
/* Delete not successful (file locked). */
7983-
send_http_error(conn,
7984-
423,
7985-
"Error: Cannot delete file\nremove(%s): %s",
7986-
path,
7987-
strerror(ERRNO));
7971+
/* Check the reason for failure. */
7972+
if (ERRNO == EACCES || ERRNO == EPERM) {
7973+
send_http_error(
7974+
conn,
7975+
403,
7976+
"Error: Delete not possible\nDeleting %s is not allowed",
7977+
path);
7978+
} else if (ERRNO == EBUSY || ERRNO == EAGAIN) {
7979+
send_http_error(conn,
7980+
423,
7981+
"Error: Cannot delete file\nremove(%s): %s",
7982+
path,
7983+
strerror(ERRNO));
7984+
} else {
7985+
send_http_error(conn,
7986+
500,
7987+
"Error: Could not delete %s\nremove(%s): %s",
7988+
path,
7989+
path,
7990+
strerror(ERRNO));
7991+
}
79887992
}
79897993
}
79907994
#endif /* !NO_FILES */

‎LinuxGUI/Ventoy2Disk/ventoy_gui.c‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
#include <stdio.h>
22
#include <stdlib.h>
33
#include <stdint.h>
4+
#include <fcntl.h>
5+
#include <unistd.h>
46
#include <string.h>
57
#include <stdarg.h>
68
#include <unistd.h>
@@ -1192,26 +1194,34 @@ static int detect_gui_exe_path(int argc, char **argv, const char *curpath, char
11921194
vlog("This is %s%d X environment.\n", guitype, ver);
11931195
vlog("exe = %s\n", pathbuf);
11941196

1195-
if (access(pathbuf, F_OK) == -1)
1197+
int fd = open(pathbuf, O_RDONLY);
1198+
if (fd == -1)
11961199
{
1197-
vlog("%s is not exist.\n", pathbuf);
1200+
vlog("%s does not exist or cannot be opened.\n", pathbuf);
11981201
return 1;
11991202
}
12001203

1201-
if (access(pathbuf, X_OK) == -1)
1204+
if (fstat(fd, &filestat) == 0)
12021205
{
1203-
vlog("execute permission check fail, try chmod.\n", pathbuf);
1204-
if (stat(pathbuf, &filestat) == 0)
1206+
if ((filestat.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0)
12051207
{
1208+
vlog("execute permission check fail, try chmod.\n");
12061209
mode = filestat.st_mode | S_IXUSR | S_IXGRP | S_IXOTH;
1207-
ret = chmod(pathbuf, mode);
1210+
ret = fchmod(fd, mode);
12081211
vlog("old mode=%o new mode=%o ret=%d\n", filestat.st_mode, mode, ret);
12091212
}
1213+
else
1214+
{
1215+
vlog("execute permission check success.\n");
1216+
}
12101217
}
12111218
else
12121219
{
1213-
vlog("execute permission check success.\n");
1220+
vlog("fstat failed on %s\n", pathbuf);
1221+
close(fd);
1222+
return 1;
12141223
}
1224+
close(fd);
12151225

12161226
return 0;
12171227
}

‎Plugson/src/Lib/libhttp/include/civetweb.c‎

Lines changed: 16 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -7977,28 +7977,26 @@ delete_file(struct mg_connection *conn, const char *path)
79777977
}
79787978

79797979
/* This is an existing file (not a directory).
7980-
* Check if write permission is granted. */
7981-
if (access(path, W_OK) != 0) {
7982-
/* File is read only */
7983-
send_http_error(
7984-
conn,
7985-
403,
7986-
"Error: Delete not possible\nDeleting %s is not allowed",
7987-
path);
7988-
return;
7989-
}
7990-
7991-
/* Try to delete it. */
7980+
* Try to delete the file directly. */
79927981
if (mg_remove(conn, path) == 0) {
79937982
/* Delete was successful: Return 204 without content. */
79947983
send_http_error(conn, 204, "%s", "");
79957984
} else {
7996-
/* Delete not successful (file locked). */
7997-
send_http_error(conn,
7998-
423,
7999-
"Error: Cannot delete file\nremove(%s): %s",
8000-
path,
8001-
strerror(ERRNO));
7985+
/* Check if the error is a permission error. */
7986+
if (ERRNO == EACCES || ERRNO == EPERM) {
7987+
send_http_error(
7988+
conn,
7989+
403,
7990+
"Error: Delete not possible\nDeleting %s is not allowed",
7991+
path);
7992+
} else {
7993+
/* Delete not successful (file locked or other error). */
7994+
send_http_error(conn,
7995+
423,
7996+
"Error: Cannot delete file\nremove(%s): %s",
7997+
path,
7998+
strerror(ERRNO));
7999+
}
80028000
}
80038001
}
80048002
#endif /* !NO_FILES */

‎Plugson/www/static/bootstrap/js/bootstrap.js‎

Lines changed: 29 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -109,11 +109,12 @@ if (typeof jQuery === 'undefined') {
109109
selector = selector && selector.replace(/.*(?=#[^\s]*$)/, '') // strip for ie7
110110
}
111111

112-
var $parent = $(selector)
113-
114-
if (e) e.preventDefault()
115-
116-
if (!$parent.length) {
112+
var $parent;
113+
if (selector && selector.charAt(0) === '#' && /^[#A-Za-z0-9\-_:.]+$/.test(selector)) {
114+
// Only allow ID selectors
115+
var el = document.getElementById(selector.slice(1));
116+
$parent = $(el);
117+
} else {
117118
$parent = $this.closest('.alert')
118119
}
119120

@@ -502,7 +503,14 @@ if (typeof jQuery === 'undefined') {
502503
var clickHandler = function (e) {
503504
var href
504505
var $this = $(this)
505-
var $target = $($this.attr('data-target') || (href = $this.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '')) // strip for ie7
506+
var targetSelector = $this.attr('data-target') || (href = $this.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, ''); // strip for ie7
507+
// Only allow ID selectors (starting with # and containing valid characters)
508+
var $target = null;
509+
if (targetSelector && /^#[A-Za-z0-9\-_:.]+$/.test(targetSelector)) {
510+
$target = $(document).find(targetSelector);
511+
} else {
512+
return;
513+
}
506514
if (!$target.hasClass('carousel')) return
507515
var options = $.extend({}, $target.data(), $this.data())
508516
var slideIndex = $this.attr('data-slide-to')
@@ -691,7 +699,7 @@ if (typeof jQuery === 'undefined') {
691699
var target = $trigger.attr('data-target')
692700
|| (href = $trigger.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '') // strip for ie7
693701

694-
return $(target)
702+
return $(document).find(target)
695703
}
696704

697705

@@ -773,7 +781,9 @@ if (typeof jQuery === 'undefined') {
773781
selector = selector && /#[A-Za-z]/.test(selector) && selector.replace(/.*(?=#[^\s]*$)/, '') // strip for ie7
774782
}
775783

776-
var $parent = selector && $(selector)
784+
// Only allow selector if it is a safe CSS selector (starts with # or . and does not contain '<')
785+
var isSafeSelector = selector && (/^#[\w-]+$/.test(selector) || (/^\.[\w-]+$/.test(selector))) && selector.indexOf('<') === -1;
786+
var $parent = isSafeSelector ? $(document).find(selector) : $this.parent();
777787

778788
return $parent && $parent.length ? $parent : $this.parent()
779789
}
@@ -1230,7 +1240,8 @@ if (typeof jQuery === 'undefined') {
12301240
$(document).on('click.bs.modal.data-api', '[data-toggle="modal"]', function (e) {
12311241
var $this = $(this)
12321242
var href = $this.attr('href')
1233-
var $target = $($this.attr('data-target') || (href && href.replace(/.*(?=#[^\s]+$)/, ''))) // strip for ie7
1243+
var selector = $this.attr('data-target') || (href && href.replace(/.*(?=#[^\s]+$)/, '')); // strip for ie7
1244+
var $target = $(document).find(selector);
12341245
var option = $target.data('bs.modal') ? 'toggle' : $.extend({ remote: !/#/.test(href) && href }, $target.data(), $this.data())
12351246

12361247
if ($this.is('a')) e.preventDefault()
@@ -1299,7 +1310,13 @@ if (typeof jQuery === 'undefined') {
12991310
this.type = type
13001311
this.$element = $(element)
13011312
this.options = this.getOptions(options)
1302-
this.$viewport = this.options.viewport && $($.isFunction(this.options.viewport) ? this.options.viewport.call(this, this.$element) : (this.options.viewport.selector || this.options.viewport))
1313+
var viewportOption = $.isFunction(this.options.viewport) ? this.options.viewport.call(this, this.$element) : (this.options.viewport.selector || this.options.viewport);
1314+
if (typeof viewportOption === 'string') {
1315+
// Use find to ensure only CSS selectors are accepted, not HTML
1316+
this.$viewport = $(document).find(viewportOption);
1317+
} else {
1318+
this.$viewport = $(viewportOption);
1319+
}
13031320
this.inState = { click: false, hover: false, focus: false }
13041321

13051322
if (this.$element[0] instanceof document.constructor && !this.options.selector) {
@@ -1554,7 +1571,7 @@ if (typeof jQuery === 'undefined') {
15541571
var $tip = this.tip()
15551572
var title = this.getTitle()
15561573

1557-
$tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](title)
1574+
$tip.find('.tooltip-inner').text(title)
15581575
$tip.removeClass('fade in top bottom left right')
15591576
}
15601577

@@ -2217,7 +2234,7 @@ if (typeof jQuery === 'undefined') {
22172234
var Affix = function (element, options) {
22182235
this.options = $.extend({}, Affix.DEFAULTS, options)
22192236

2220-
this.$target = $(this.options.target)
2237+
this.$target = $(document).find(this.options.target)
22212238
.on('scroll.bs.affix.data-api', $.proxy(this.checkPosition, this))
22222239
.on('click.bs.affix.data-api', $.proxy(this.checkPositionWithEventLoop, this))
22232240

‎SQUASHFS/squashfs-tools-4.4/squashfs-tools/lzma_xz_wrapper.c‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,19 @@
2525
#include <string.h>
2626
#include <lzma.h>
2727

28+
#if defined(__STDC_LIB_EXT1__)
29+
/* Use memset_s if available */
30+
#define secure_memset(dest, value, len) memset_s((dest), (len), (value), (len))
31+
#else
32+
/* Fallback secure_memset implementation */
33+
static void secure_memset(void *v, int c, size_t n) {
34+
volatile unsigned char *p = (volatile unsigned char *)v;
35+
while (n--) {
36+
*p++ = (unsigned char)c;
37+
}
38+
}
39+
#endif
40+
2841
#include "squashfs_fs.h"
2942
#include "compressor.h"
3043

@@ -120,7 +133,7 @@ static int lzma_uncompress(void *dest, void *src, int size, int outsize,
120133
goto failed;
121134
}
122135

123-
memset(lzma_header + LZMA_PROPS_SIZE, 255, LZMA_UNCOMP_SIZE);
136+
secure_memset(lzma_header + LZMA_PROPS_SIZE, 255, LZMA_UNCOMP_SIZE);
124137

125138
strm.next_out = dest;
126139
strm.avail_out = outsize;

0 commit comments

Comments
 (0)