jingfei195887 opened a new pull request, #21775:
URL: https://github.com/apache/nuttx/pull/21775
## Summary
- **fs/procfs: bound the cmdline argument copy by the user buffer.**
`proc_cmdline()` copies the argument list with `procfs_memcpy()` using
`sizeof(procfile->line)` as the destination size instead of the space left
in the user buffer. A `read()` of `/proc/<pid>/cmdline` shorter than the
command line writes past the caller's buffer, and the `size_t remaining`
wraps, so `read()` returns more bytes than requested. Pass `remaining`,
as the other two copies in the same function already do.
## Impact
Only short reads of `/proc/<pid>/cmdline`: they now return at most the
requested size and no longer write past the user buffer. Full reads are
unchanged.
## Testing
Host: Ubuntu x86_64, gcc (Ubuntu 13.1.0-8ubuntu1~22.04) 13.1.0, master
dc9481383e, `sim:nsh` (`CONFIG_FS_PROCFS`).
A test task with a 67-byte command line reads its own `/proc/<pid>/cmdline`
once for every size from 1 to 66, into a buffer filled with a guard pattern,
and counts reads that return more than requested or touch the bytes after
the requested size:
| | master | this PR |
|---|---|---|
| short reads past the buffer | 57 of 66 (first at 9 bytes, `read()`
returned 67) | 0 of 66 |
- `./tools/checkpatch.sh -g master..HEAD`: all checks pass.
- Make and CMake builds pass with no new warnings; `ostest` exits with
status 0.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
