[Bug] Heap Buffer Overflow in FinSH `msh_auto_complete_path` via Oversized Input
维护者通常 1 天内回复
@Acen28 已经在做这个了。
开始于 2026年9月26日。
评估
这个 Issue 还没有评估数据。
描述
RT-Thread Version
v5.3.0/git-hash: cda0a63
Affected area
FinSH
Hardware/BSP vendor
STM32
Architecture
ARM / AArch64
Board and hardware details
bsp/stm32/stm32f407-atk-explorer
Develop Toolchain
GCC
Describe the bug
Description
A critical Heap Out-of-Bounds (OOB) Write vulnerability (CWE-122) exists within the RT-Thread FinSH component, specifically in the path auto-completion logic (msh_auto_complete_path or related directory parsing functions).
When a user interacts with the msh shell (e.g., via a serial terminal or a remote network console) and attempts to trigger path auto-completion (typically using the <Tab> key) on an excessively long or deeply nested directory string, the underlying string manipulation routine fails to enforce strict boundary checks.
The function allocates a fixed-size buffer on the heap (often bounded by macros like RT_PATH_MAX or a hardcoded 256 bytes, e.g., full_path). During the concatenation of the current working directory and the user-supplied input, a while loop or strcpy/memcpy equivalent copies the oversized input string past the allocated bounds of the heap buffer.
This silent memory corruption overwrites adjacent heap metadata. The system does not crash immediately upon the OOB write. However, during the next memory allocation or deallocation cycle, the corrupted heap metadata is dereferenced, leading to an immediate HardFault or offering an attacker the potential for Heap-based Arbitrary Code Execution.
Prerequisites to Reproduce
- The FinSH/msh component is enabled and accessible to the user/attacker.
- The
RT_USING_DFS(Device Virtual File System) andRT_USING_DFS_DEVFSare enabled, allowing directory traversal and path completion.
Steps to Reproduce
- Boot the RT-Thread system and connect to the FinSH interactive shell (via UART or Telnet).
- Input an excessively long string intended as a directory path. For example, input
cd /followed by a payload of over 256 'A' characters:
msh > cd /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA... - Trigger the auto-complete function (usually by sending the
\t(Tab) character via the input stream). - The
msh_auto_complete_pathfunction attempts to parse and concatenate the path. The oversized string silently overflows thefull_pathheap buffer. - Execute any subsequent command that requires dynamic memory allocation (e.g.,
lsor running a network task). - The system throws a HardFault (or MemManage fault) due to corrupted heap metadata during
rt_mallocorrt_free.
Other additional context
No response
- 主要语言
- C
- 星标
- 12.3k
- 派生
- 5.5k
- 平均合并
- 4 天 12 小时
- 30 天内合并 PR
- 32
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
RT-Thread/rt-thread 的其他 Issue
-
[Bug] [netdev] ping crashes the shell with a division by zero when the target is unreachable (received == 0)可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭bug Component component: net
难度 1/5 1 小时以内 新手友好度 90/100
RT-Thread/rt-thread#11852 · 1 条评论 ·
维护者通常 1 天内回复
-
[bsp][stm32][bluepill] README「快速上手」缺少重新生成 MDK 工程这一步，按文档操作无法编译通过可能已有人在做 @moment-NEW 于 3 天前认领。 未关闭in progress
难度 2/5 1-3 小时 新手友好度 75/100
RT-Thread/rt-thread#11818 · 4 条评论 · 已指派 1 人 ·
维护者通常 1 天内回复
-
BSP BSP: Loongson bug RT-Smart
难度 2/5 1-3 小时 新手友好度 72/100
RT-Thread/rt-thread#11717 · 2 条评论 ·
维护者通常 1 天内回复
-
Arch: RISC-V BSP BSP: HPMicro bug
难度 2/5 1-3 小时 新手友好度 72/100
RT-Thread/rt-thread#11687 · 3 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
RT-Thread/rt-thread#11472 · 1 条评论 ·
维护者通常 1 天内回复
查看 RT-Thread/rt-thread 的全部 Issue
相似的 Issue
-
[P2] Workspace updates silently ignore forbidden assignments while staging the row可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 70/100
维护者通常 4 天内回复
-
category:port-update
难度 2/5 1-3 小时 新手友好度 72/100
microsoft/vcpkg#54338 · 1 条评论 ·
维护者通常 2 天内回复
-
area:http-gateway good first issue priority:low type:docs
难度 2/5 1-3 小时 新手友好度 88/100
crazy-goat/php-fpm-ng#828 ·
维护者通常 1 天内回复
-
enhancement
难度 2/5 1-3 小时 新手友好度 63/100
SunDevilRocketry/Flight-Computer-Firmware#347 ·
维护者通常 3 天内回复