This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 3173a0c2cba9996009d07cfdd55b71d9eefdbb4c Author: Marco Casaroli <[email protected]> AuthorDate: Mon Oct 19 02:03:58 2026 +0200 fs/romfs: Do not read outside of the volume. ROMFS takes the offsets of file headers, hard link targets and names from the image, and romfs_devcacheread() did not check them. In XIP mode it added the offset to the image address, so a damaged image gave a bad pointer and the kernel stopped with a load exception. For example, an image with no entries puts the root directory at the end of the volume. The mount then reads the data after the image and follows it as a hard link. romfs_devcacheread() now returns -EIO if the 16-byte chunk at the offset is not fully in the volume. The mount or the lookup then fails and the system continues. romfs_datastart() already does the same check. Assisted-by: Claude Code:claude-opus-5-5 Signed-off-by: Marco Casaroli <[email protected]> --- fs/romfs/fs_romfsutil.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/fs/romfs/fs_romfsutil.c b/fs/romfs/fs_romfsutil.c index 17a1c9309c5..c85c343ecaa 100644 --- a/fs/romfs/fs_romfsutil.c +++ b/fs/romfs/fs_romfsutil.c @@ -173,6 +173,17 @@ static int16_t romfs_devcacheread(FAR struct romfs_mountpt_s *rm, uint32_t sector; int ret; + /* The offset comes from the image. Do not read a 16-byte chunk outside + * of the volume. rm_volsize is zero only while the header is read. + */ + + if (rm->rm_volsize != 0 && + (offset >= rm->rm_volsize || + rm->rm_volsize - offset < ROMFS_ALIGNMENT)) + { + return -EIO; + } + /* rm->rm_cachesector holds the current sector that is buffer in or * referenced by rm->rm_buffer. If the requested sector is the same as this * this then we do nothing.
