Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

[Bug] Heap Buffer Overflow in FinSH `msh_auto_complete_path` via Oversized Input

Aberta
  • Algo errado?
#11,839 3 comentários 0 reações 1 responsável Ver no GitHub

Mantenedores costumam responder em até 1 dia

@Acen28 já está trabalhando nisso.

Desde 26/9/2026.

Avaliação

Esta issue ainda não foi avaliada.

Descrição

Arch: ARM/AArch64 BSP BSP: STM32 bug Component component: finsh in progress
RT-Thread Version

v5.3.0/git-hash: cda0a63

Affected area

FinSH

Hardware/BSP vendor

STM32

Architecture

ARM / AArch64

Board and hardware details

bsp/stm32/stm32f407-atk-explorer

Develop Toolchain

GCC

Describe the bug

Description
A critical Heap Out-of-Bounds (OOB) Write vulnerability (CWE-122) exists within the RT-Thread FinSH component, specifically in the path auto-completion logic (msh_auto_complete_path or related directory parsing functions).

When a user interacts with the msh shell (e.g., via a serial terminal or a remote network console) and attempts to trigger path auto-completion (typically using the <Tab> key) on an excessively long or deeply nested directory string, the underlying string manipulation routine fails to enforce strict boundary checks.

The function allocates a fixed-size buffer on the heap (often bounded by macros like RT_PATH_MAX or a hardcoded 256 bytes, e.g., full_path). During the concatenation of the current working directory and the user-supplied input, a while loop or strcpy/memcpy equivalent copies the oversized input string past the allocated bounds of the heap buffer.

This silent memory corruption overwrites adjacent heap metadata. The system does not crash immediately upon the OOB write. However, during the next memory allocation or deallocation cycle, the corrupted heap metadata is dereferenced, leading to an immediate HardFault or offering an attacker the potential for Heap-based Arbitrary Code Execution.

Prerequisites to Reproduce

  1. The FinSH/msh component is enabled and accessible to the user/attacker.
  2. The RT_USING_DFS (Device Virtual File System) and RT_USING_DFS_DEVFS are enabled, allowing directory traversal and path completion.

Steps to Reproduce

  1. Boot the RT-Thread system and connect to the FinSH interactive shell (via UART or Telnet).
  2. Input an excessively long string intended as a directory path. For example, input cd / followed by a payload of over 256 'A' characters:
    msh > cd /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...
  3. Trigger the auto-complete function (usually by sending the \t (Tab) character via the input stream).
  4. The msh_auto_complete_path function attempts to parse and concatenate the path. The oversized string silently overflows the full_path heap buffer.
  5. Execute any subsequent command that requires dynamic memory allocation (e.g., ls or running a network task).
  6. The system throws a HardFault (or MemManage fault) due to corrupted heap metadata during rt_malloc or rt_free.
Other additional context

No response

Linguagem predominante
C
Estrelas
12.3k
Forks
5.5k
Merge médio
6d 32min
PRs com merge (30d)
24

Preparar o ambiente

Abrir no Codespaces

Inicia o contêiner de desenvolvimento do projeto no navegador, com a sua própria conta do GitHub.

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de RT-Thread/rt-thread

Todas as issues de RT-Thread/rt-thread

Issues semelhantes

Mais issues de C

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.