(nuttx-apps) branch master updated: system: fastboot: bound filedump path parsing

[xiaoxiang]

This is an automated email from the ASF dual-hosted git repository.

xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx-apps.git


The following commit(s) were added to refs/heads/master by this push:
     new 62d04ed48 system: fastboot: bound filedump path parsing
62d04ed48 is described below

commit 62d04ed4846ec3346c001edd6965ee311499edde
Author: Old-Ding <35417409+old-d...@users.noreply.github.com>
AuthorDate: Sat Jul 11 12:59:27 2026 +0800

    system: fastboot: bound filedump path parsing
    
    Parse the filedump path token into the existing PATH_MAX-sized buffer
    before reading the optional offset and size arguments. This bounds the
    write without constructing a scanf format string at runtime.
    
    Signed-off-by: Old-Ding <35417409+old-d...@users.noreply.github.com>
---
 system/fastboot/fastboot.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/system/fastboot/fastboot.c b/system/fastboot/fastboot.c
index d443bb9c8..8c7448e3e 100644
--- a/system/fastboot/fastboot.c
+++ b/system/fastboot/fastboot.c
@@ -871,6 +871,7 @@ static void fastboot_filedump(FAR struct fastboot_ctx_s 
*ctx,
                               FAR const char *arg)
 {
   struct stat sb;
+  size_t len;
   int ret;
 
   if (!arg)
@@ -879,14 +880,30 @@ static void fastboot_filedump(FAR struct fastboot_ctx_s 
*ctx,
       return;
     }
 
-  ret = sscanf(arg, "%s %" PRIdOFF " %zu", ctx->upload_param.u.file.path,
+  arg += strspn(arg, " \t\r\n");
+  len = strcspn(arg, " \t\r\n");
+  if (len == 0)
+    {
+      fastboot_fail(ctx, "Failed to parse arguments");
+      return;
+    }
+
+  if (len >= sizeof(ctx->upload_param.u.file.path))
+    {
+      len = sizeof(ctx->upload_param.u.file.path) - 1;
+    }
+
+  memcpy(ctx->upload_param.u.file.path, arg, len);
+  ctx->upload_param.u.file.path[len] = '\0';
+
+  ret = sscanf(arg + len, "%" PRIdOFF " %zu",
                &ctx->upload_param.u.file.offset, &ctx->upload_param.size);
-  if (ret != 1 && ret != 3)
+  if (ret != EOF && ret != 0 && ret != 2)
     {
       fastboot_fail(ctx, "Failed to parse arguments");
       return;
     }
-  else if (ret == 1)
+  else if (ret != 2)
     {
       ret = stat(ctx->upload_param.u.file.path, &sb);
       if (ret < 0)