This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 1519a7862f3ea3a2fa909bea5c0b375c328a10df Author: yukangzhi <[email protected]> AuthorDate: Fri Jul 3 10:20:40 2026 +0800 fs/inode: fix off-by-one in _inode_checkpath NAME_MAX check The loop condition 'namelen <= NAME_MAX' allowed filenames of NAME_MAX+1 characters to pass validation. When the filename segment reached exactly NAME_MAX+1 chars and was at the end of the path string, the loop exited due to *path == '\0' and returned OK instead of -ENAMETOOLONG. Fix by moving the NAME_MAX check inside the loop body with an immediate return on violation. Also fix the post-loop return to explicitly check pathlen >= PATH_MAX instead of relying on *path which conflated the two exit conditions. Before: creat() with 97-char filename (NAME_MAX=96) succeeded After: creat() with 97-char filename correctly returns ENAMETOOLONG Signed-off-by: yukangzhi <[email protected]> --- fs/inode/fs_inodesearch.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/inode/fs_inodesearch.c b/fs/inode/fs_inodesearch.c index c700e61234d..809714ffef5 100644 --- a/fs/inode/fs_inodesearch.c +++ b/fs/inode/fs_inodesearch.c @@ -256,7 +256,7 @@ static int _inode_checkpath(const char *path) /* Check each segment of the path */ - while (*path != '\0' && namelen <= NAME_MAX && pathlen < PATH_MAX) + while (*path != '\0' && pathlen < PATH_MAX) { if (*path == '/') { @@ -264,14 +264,17 @@ static int _inode_checkpath(const char *path) } else { - namelen++; + if (++namelen > NAME_MAX) + { + return -ENAMETOOLONG; + } } path++; pathlen++; } - return *path != '\0' ? -ENAMETOOLONG : OK; + return pathlen >= PATH_MAX ? -ENAMETOOLONG : OK; } /****************************************************************************
