This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new b9c9c238e8c fs/romfs: reject negative resulting position in
romfs_seek()
b9c9c238e8c is described below
commit b9c9c238e8c4074de856fb88e57729b697b4e311
Author: yi chen <[email protected]>
AuthorDate: Mon Jul 13 10:58:47 2026 +0800
fs/romfs: reject negative resulting position in romfs_seek()
romfs_seek() clamps the computed position to the file size when it
exceeds rf_size, but never checks for a negative result. lseek(fd,
offset, SEEK_SET/SEEK_CUR/SEEK_END) with an offset that produces a
negative position (e.g. a negative SEEK_SET offset, or a SEEK_CUR/
SEEK_END offset more negative than the current position/file size)
is written straight into filep->f_pos.
The subsequent romfs_read() computes
`rf->rf_startoffset + filep->f_pos` into a uint32_t, so a negative
f_pos wraps around to a huge unsigned offset, and romfs_hwread()'s
XIP path memcpy()s from rm_xipbase plus that offset -- an
out-of-bounds read far past the mapped flash region.
Add the same "if (position < 0) return -EINVAL" guard already used
by fs/fat/fs_fat32.c's seek function, before the existing
end-of-file clamp.
Signed-off-by: yi chen <[email protected]>
Assisted-by: Claude:claude-sonnet-5
---
fs/romfs/fs_romfs.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/fs/romfs/fs_romfs.c b/fs/romfs/fs_romfs.c
index e4c98131592..07eeee39137 100644
--- a/fs/romfs/fs_romfs.c
+++ b/fs/romfs/fs_romfs.c
@@ -563,6 +563,13 @@ static off_t romfs_seek(FAR struct file *filep, off_t
offset, int whence)
goto errout_with_lock;
}
+ if (position < 0)
+ {
+ ferr("ERROR: Invalid position: %jd\n", (intmax_t)position);
+ ret = -EINVAL;
+ goto errout_with_lock;
+ }
+
/* Limit positions to the end of the file. */
if (position > rf->rf_size)
