From 418c79ed06818065f6b227cc97bacce623b70687 Mon Sep 17 00:00:00 2001 From: Old-Ding Date: Mon, 6 Jul 2026 07:07:11 +0800 Subject: [PATCH] system: fastboot: bound filedump path parsing Build the filedump sscanf format with a path width derived from the destination buffer so the path token cannot overflow upload_param.u.file.path while preserving the existing filedump argument forms. Signed-off-by: Old-Ding --- system/fastboot/fastboot.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/system/fastboot/fastboot.c b/system/fastboot/fastboot.c index d443bb9c879..83b29528446 100644 --- a/system/fastboot/fastboot.c +++ b/system/fastboot/fastboot.c @@ -870,6 +870,7 @@ static int fastboot_filedump_upload(FAR struct fastboot_ctx_s *ctx) static void fastboot_filedump(FAR struct fastboot_ctx_s *ctx, FAR const char *arg) { + char format[64]; struct stat sb; int ret; @@ -879,7 +880,10 @@ static void fastboot_filedump(FAR struct fastboot_ctx_s *ctx, return; } - ret = sscanf(arg, "%s %" PRIdOFF " %zu", ctx->upload_param.u.file.path, + snprintf(format, sizeof(format), "%%%zus %%" PRIdOFF " %%zu", + sizeof(ctx->upload_param.u.file.path) - 1); + + ret = sscanf(arg, format, ctx->upload_param.u.file.path, &ctx->upload_param.u.file.offset, &ctx->upload_param.size); if (ret != 1 && ret != 3) {