94xhn commented on PR #19420: URL: https://github.com/apache/nuttx/pull/19420#issuecomment-5343211756
Done — built and ran this on the actual sim target (boards/sim, apps/examples/romfs mounting a real romfs ramdisk), not just a host-side reproduction. I added a temporary probe to apps/examples/romfs after the mount succeeds: open a real file, then `lseek(fd, -100, SEEK_SET)`. Without the fix (temporarily reverted the guard, rebuilt, ran on sim): ``` SEEKTEST: lseek(-100, SEEK_SET) = 15 errno=0 (Success) SEEKTEST: after bad seek, read() = 0 errno=0, bytes=[] ``` The negative offset is silently accepted -- no error, filep->f_pos ends up negative. (For this particular ramdisk-backed test file the subsequent read() just came back empty rather than crashing outright; the wilder out-of-bounds read from the original report needs the XIP path with a larger negative magnitude, but the core defect -- an invalid position being accepted at all -- reproduces cleanly here.) With the fix (rebuilt again with the guard restored): ``` SEEKTEST: lseek(-100, SEEK_SET) = -1 errno=22 (Invalid argument) SEEKTEST: negative seek correctly rejected, no read attempted ``` Removed the probe before pushing -- the PR itself is unchanged, this was just to get a real on-target run instead of relying on the host-side harness. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
