From 638c22bd9ae205156952152c66be7e548b81b757 Mon Sep 17 00:00:00 2001 From: Vladimir Umek Date: Wed, 26 Aug 2026 13:22:54 +0200 Subject: [PATCH 1/4] FileSystem: prevent truncation of cached directory entry offsets above 255 --- Components/FileSystem/Source/fs_fat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Components/FileSystem/Source/fs_fat.c b/Components/FileSystem/Source/fs_fat.c index ac15138c..9219c780 100644 --- a/Components/FileSystem/Source/fs_fat.c +++ b/Components/FileSystem/Source/fs_fat.c @@ -2468,7 +2468,7 @@ static fsStatus frec_find_elink (PATH_INFO *pinfo, fsFAT_Volume *vol) { pinfo->frec.cnt = (uint8_t)el->Info.EntryCount; pinfo->frec.pos.Clus = el->Info.EntryClus; - pinfo->frec.pos.Offs = (uint8_t)el->Info.EntryOffs; + pinfo->frec.pos.Offs = (uint16_t)el->Info.EntryOffs; pos.Clus = pinfo->frec.pos.Clus; pos.Offs = pinfo->frec.pos.Offs; From d3c757fb55434037e1f4ec14bfdddb5696bc36b3 Mon Sep 17 00:00:00 2001 From: Vladimir Umek Date: Wed, 26 Aug 2026 13:26:51 +0200 Subject: [PATCH 2/4] FileSystem: prevent out of bounds array access for deep paths in name cache --- Components/FileSystem/Source/fs_fat_elink.c | 46 ++++++++++++++++----- 1 file changed, 35 insertions(+), 11 deletions(-) diff --git a/Components/FileSystem/Source/fs_fat_elink.c b/Components/FileSystem/Source/fs_fat_elink.c index c2d1c5b4..1008fd2f 100644 --- a/Components/FileSystem/Source/fs_fat_elink.c +++ b/Components/FileSystem/Source/fs_fat_elink.c @@ -1,6 +1,6 @@ /*------------------------------------------------------------------------------ * MDK Middleware - Component ::File System - * Copyright (c) 2004-2020 Arm Limited (or its affiliates). All rights reserved. + * Copyright (c) 2004-2026 Arm Limited (or its affiliates). All rights reserved. *------------------------------------------------------------------------------ * Name: fs_fat_elink.c * Purpose: FAT File System Entry Link Cache implementation @@ -362,6 +362,11 @@ __WEAK uint32_t elink_scan (uint32_t nameH, ELINK **el, NCACHE *p) { } nc = (ELINK_CACHE_CB *)p->buf; + if (nc->Depth >= p->max_path_depth) { + /* Path depth exceeds configured max path depth */ + return (1); + } + tl = elink_rewind (nc->Dir, nc); while (tl != NULL) { @@ -402,6 +407,11 @@ __WEAK uint32_t elink_delete (ELINK *el, NCACHE *p) { } nc = (ELINK_CACHE_CB *)p->buf; + if (nc->Depth >= p->max_path_depth) { + /* Path depth exceeds configured max path depth */ + return (1); + } + if (el) { /* Disconnect link from the entry link chain */ elink_discon (el); @@ -435,6 +445,11 @@ __WEAK uint32_t elink_insert (ELINK *nl, NCACHE *p) { } nc = (ELINK_CACHE_CB *)p->buf; + if (nc->Depth >= p->max_path_depth) { + /* Path depth exceeds configured max path depth */ + return (1); + } + /* Take oldest link from the used list */ el = nc->Used[nc->Depth].Oldest; @@ -536,6 +551,25 @@ __WEAK ELINK *elink_cmd (uint32_t cmd, NCACHE *p) { } nc = (ELINK_CACHE_CB *)p->buf; + /* Process commands that shall always be executed */ + switch (cmd) { + case ELINK_CMD_CHDIR: + /* Set current directory depth */ + nc->Depth_CD = nc->Depth; + break; + + case ELINK_CMD_FLUSH: + /* Flush name cache */ + elink_flush (p->max_path_depth, nc); + break; + } + + if (nc->Depth >= p->max_path_depth) { + /* Path depth exceeds configured max path depth */ + return (NULL); + } + + /* Process commands that depend on current path depth */ switch (cmd) { case ELINK_CMD_DIR_REWIND: /* Rewind to the beginning of users directory */ @@ -562,16 +596,6 @@ __WEAK ELINK *elink_cmd (uint32_t cmd, NCACHE *p) { case ELINK_CMD_ALLOC: /* Allocate name entry link */ return (elink_alloc (p->max_path_depth, nc)); - - case ELINK_CMD_CHDIR: - /* Set current directory depth */ - nc->Depth_CD = nc->Depth; - break; - - case ELINK_CMD_FLUSH: - /* Flush name cache */ - elink_flush (p->max_path_depth, nc); - break; } return (nc->Used[nc->Depth].Latest); From 0082b8c61e159460b40771aaaca4a0fe822d48b6 Mon Sep 17 00:00:00 2001 From: Vladimir Umek Date: Wed, 26 Aug 2026 15:50:43 +0200 Subject: [PATCH 3/4] FileSystem: correct elink_rewind - rewind could return an entry from another directory --- Components/FileSystem/Source/fs_fat_elink.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/Components/FileSystem/Source/fs_fat_elink.c b/Components/FileSystem/Source/fs_fat_elink.c index 1008fd2f..e091252e 100644 --- a/Components/FileSystem/Source/fs_fat_elink.c +++ b/Components/FileSystem/Source/fs_fat_elink.c @@ -336,6 +336,11 @@ static ELINK *elink_rewind (uint32_t dir, ELINK_CACHE_CB *nc) { } } } + + if ((el != NULL) && (el->Info.DirClus != dir)) { + /* Requested directory has no entries in the cache */ + el = NULL; + } return (el); } @@ -578,16 +583,22 @@ __WEAK ELINK *elink_cmd (uint32_t cmd, NCACHE *p) { if (el != NULL) { delete_list_update (el, nc->Depth, nc); } - break; + return (el); case ELINK_CMD_POS_INC: /* Set next link as the latest used */ - el = nc->Used[nc->Depth].Latest->Next; + el = nc->Used[nc->Depth].Latest; if (el != NULL) { - delete_list_update (el, nc->Depth, nc); + el = el->Next; + + if ((el != NULL) && (el->Info.DirClus == nc->Dir)) { + /* Next cached entry belongs to the current directory */ + delete_list_update (el, nc->Depth, nc); + return (el); + } } - break; + return (NULL); case ELINK_CMD_GET_LAST: /* Return last used entry link */ From 7fe754b2100aa8d8800f7bf44dd9b201b8c30ef1 Mon Sep 17 00:00:00 2001 From: Vladimir Umek Date: Tue, 1 Sep 2026 10:21:29 +0200 Subject: [PATCH 4/4] FileSystem: update version and revision history --- Components/FileSystem/FileSystem.scvd | 2 +- Components/FileSystem/Include/rl_fs.h | 2 +- Documentation/Doxygen/FileSystem/src/revision_history.md | 3 ++- Documentation/Doxygen/General/src/revision_history.md | 2 +- Keil.MDK-Middleware.pdsc | 5 +++-- 5 files changed, 8 insertions(+), 6 deletions(-) diff --git a/Components/FileSystem/FileSystem.scvd b/Components/FileSystem/FileSystem.scvd index ced19ed0..495c643c 100644 --- a/Components/FileSystem/FileSystem.scvd +++ b/Components/FileSystem/FileSystem.scvd @@ -1,7 +1,7 @@ - + diff --git a/Components/FileSystem/Include/rl_fs.h b/Components/FileSystem/Include/rl_fs.h index 3c096114..305dd598 100644 --- a/Components/FileSystem/Include/rl_fs.h +++ b/Components/FileSystem/Include/rl_fs.h @@ -14,7 +14,7 @@ #define MW_FS_VERSION_MAJOR 8 #define MW_FS_VERSION_MINOR 0 -#define MW_FS_VERSION_PATCH 9 +#define MW_FS_VERSION_PATCH 10 // ==== Enumeration, structures, defines ==== diff --git a/Documentation/Doxygen/FileSystem/src/revision_history.md b/Documentation/Doxygen/FileSystem/src/revision_history.md index ccb4f0b9..c5af2739 100644 --- a/Documentation/Doxygen/FileSystem/src/revision_history.md +++ b/Documentation/Doxygen/FileSystem/src/revision_history.md @@ -6,12 +6,13 @@ Description - V8.0.9 + V8.0.10 - corrected a bug in ffind for EFS which could return invalid file for explicit search - corrected fchdrive to correctly handle NULL argument - corrected funmount for FAT drives when called multiple times - corrected file open to return fsTooManyOpenFiles when there is no file handle available + - corrected FAT name cache out of bound access for deep paths - corrected FAT name cache entry size from 48 to 40 bytes - corrected various minor code quality issues diff --git a/Documentation/Doxygen/General/src/revision_history.md b/Documentation/Doxygen/General/src/revision_history.md index 582ce2b9..e94cb277 100644 --- a/Documentation/Doxygen/General/src/revision_history.md +++ b/Documentation/Doxygen/General/src/revision_history.md @@ -13,7 +13,7 @@ V8.3.1 - Network Component Version 8.3.1 - - FileSystem Component Version 8.0.9 + - FileSystem Component Version 8.0.10 - USB Component Version 8.0.2 (unchanged) diff --git a/Keil.MDK-Middleware.pdsc b/Keil.MDK-Middleware.pdsc index 51e41284..91cd75f8 100644 --- a/Keil.MDK-Middleware.pdsc +++ b/Keil.MDK-Middleware.pdsc @@ -14,11 +14,12 @@ Active development ... - FileSystem Component Version 8.0.9 + FileSystem Component Version 8.0.10 - corrected a bug in ffind for EFS which could return invalid file for explicit search - corrected fchdrive to correctly handle NULL argument - corrected funmount for FAT drives when called multiple times - corrected file open to return fsTooManyOpenFiles when there is no file handle available + - corrected FAT name cache out of bound access for deep paths - corrected FAT name cache entry size from 48 to 40 bytes - corrected various minor code quality issues Network Component Version 8.3.1 @@ -1167,7 +1168,7 @@ - + File Access on various storage devices Documentation/html/FileSystem/index.html