This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new 74710cd89bd libc/termios: check lib_get_tempbuffer() return in
ttyname_r
74710cd89bd is described below
commit 74710cd89bd3a9d7d5c6c8340405ae85a1d90e28
Author: Junbo Zheng <[email protected]>
AuthorDate: Thu Nov 5 22:24:36 2026 +0800
libc/termios: check lib_get_tempbuffer() return in ttyname_r
Coverity static analysis reported a NULL_RETURNS defect in
ttyname_r(): lib_get_tempbuffer() returns NULL when the temp buffer
pool is exhausted and the fallback allocation fails, but the pointer
was passed straight to fcntl(F_GETPATH) and strlen() without a NULL
check, dereferencing NULL on allocation failure.
Every other caller of lib_get_tempbuffer() in the tree already
handles the NULL return (hostfs, glob, getgrgid_r path, gcov);
ttyname_r() was the only one that did not. Return ENOMEM, which
matches both the error contract of ttyname_r() and the convention
used by those callers.
Testing:
```
cmake -B build -DBOARD_CONFIG=sim:nsh
cmake --build build -j$(nproc)
```
Signed-off-by: Junbo Zheng <[email protected]>
---
libs/libc/termios/lib_ttynamer.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libs/libc/termios/lib_ttynamer.c b/libs/libc/termios/lib_ttynamer.c
index 1efa84608b3..237d0c7c982 100644
--- a/libs/libc/termios/lib_ttynamer.c
+++ b/libs/libc/termios/lib_ttynamer.c
@@ -80,6 +80,11 @@ int ttyname_r(int fd, FAR char *buf, size_t buflen)
FAR char *path = lib_get_tempbuffer(PATH_MAX);
int ret;
+ if (path == NULL)
+ {
+ return ENOMEM;
+ }
+
if (fcntl(fd, F_GETPATH, path) < 0)
{
ret = get_errno();
