Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

[Bug] Heap Buffer Overflow in FinSH `msh_auto_complete_path` via Oversized Input

Offen
  • Stimmt etwas nicht?
#11,839 3 Kommentare 0 Reaktionen 1 zugewiesene Person Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

@Acen28 arbeitet bereits daran.

Seit 26.9.2026.

Bewertung

Dieses Issue wurde noch nicht bewertet.

Beschreibung

Arch: ARM/AArch64 BSP BSP: STM32 bug Component component: finsh in progress
RT-Thread Version

v5.3.0/git-hash: cda0a63

Affected area

FinSH

Hardware/BSP vendor

STM32

Architecture

ARM / AArch64

Board and hardware details

bsp/stm32/stm32f407-atk-explorer

Develop Toolchain

GCC

Describe the bug

Description
A critical Heap Out-of-Bounds (OOB) Write vulnerability (CWE-122) exists within the RT-Thread FinSH component, specifically in the path auto-completion logic (msh_auto_complete_path or related directory parsing functions).

When a user interacts with the msh shell (e.g., via a serial terminal or a remote network console) and attempts to trigger path auto-completion (typically using the <Tab> key) on an excessively long or deeply nested directory string, the underlying string manipulation routine fails to enforce strict boundary checks.

The function allocates a fixed-size buffer on the heap (often bounded by macros like RT_PATH_MAX or a hardcoded 256 bytes, e.g., full_path). During the concatenation of the current working directory and the user-supplied input, a while loop or strcpy/memcpy equivalent copies the oversized input string past the allocated bounds of the heap buffer.

This silent memory corruption overwrites adjacent heap metadata. The system does not crash immediately upon the OOB write. However, during the next memory allocation or deallocation cycle, the corrupted heap metadata is dereferenced, leading to an immediate HardFault or offering an attacker the potential for Heap-based Arbitrary Code Execution.

Prerequisites to Reproduce

  1. The FinSH/msh component is enabled and accessible to the user/attacker.
  2. The RT_USING_DFS (Device Virtual File System) and RT_USING_DFS_DEVFS are enabled, allowing directory traversal and path completion.

Steps to Reproduce

  1. Boot the RT-Thread system and connect to the FinSH interactive shell (via UART or Telnet).
  2. Input an excessively long string intended as a directory path. For example, input cd / followed by a payload of over 256 'A' characters:
    msh > cd /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...
  3. Trigger the auto-complete function (usually by sending the \t (Tab) character via the input stream).
  4. The msh_auto_complete_path function attempts to parse and concatenate the path. The oversized string silently overflows the full_path heap buffer.
  5. Execute any subsequent command that requires dynamic memory allocation (e.g., ls or running a network task).
  6. The system throws a HardFault (or MemManage fault) due to corrupted heap metadata during rt_malloc or rt_free.
Other additional context

No response

Vorherrschende Sprache
C
Sterne
12.3k
Forks
5.5k
Ø Merge
4 T. 12 Std.
Gemergte PRs (30 T.)
32

Entwicklungsumgebung

In Codespaces öffnen

Startet den Dev-Container des Projekts im Browser, mit Ihrem eigenen GitHub-Konto.

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus RT-Thread/rt-thread

Alle Issues in RT-Thread/rt-thread

Ähnliche Issues

Weitere Issues zu C

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.