Closed crc-32 closed 4 years ago
The colon :
isn't a valid filename character. How can this even happen normally?
Surely it's better to handle reserved characters and report back with some form of error instead of causing a segfault. It can happen when user input is provided verbatim to, for example, the mkdir function or possibly in FTP scenarios where a path is created from a Linux client that includes a colon (as Linux supports colons in filenames)
mkdir used as an example as it's where the bug was first noticed.
https://github.com/devkitPro/newlib/blob/devkitA64/libgloss/libsysbase/iosupport.c#L70 https://github.com/devkitPro/newlib/blob/devkitA64/libgloss/libsysbase/iosupport.c#L80 When provided with the path, these lines then assume that the first colon it finds is separating the device from the path, which isn't necessarily true as relative paths don't include any devices, so the function ends up trying to resolve the first half before the colon as a device resulting in it returning -1 making mkdir read at index -1 of devoptab_list causing a segfault, this likely affects other fs functions.