From 6f54ab571662c7438b319da8668ef513bb65feac Mon Sep 17 00:00:00 2001 From: Michael Scire Date: Wed, 23 Mar 2022 13:38:34 -0700 Subject: [PATCH] fs: fix out of bounds access when parsing directory paths --- .../stratosphere/fs/common/fs_directory_path_parser.hpp | 7 +++---- .../fssystem/fssystem_directory_redirection_filesystem.hpp | 4 ++-- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/libraries/libstratosphere/include/stratosphere/fs/common/fs_directory_path_parser.hpp b/libraries/libstratosphere/include/stratosphere/fs/common/fs_directory_path_parser.hpp index 0f7cdd7d5..fcff1022f 100644 --- a/libraries/libstratosphere/include/stratosphere/fs/common/fs_directory_path_parser.hpp +++ b/libraries/libstratosphere/include/stratosphere/fs/common/fs_directory_path_parser.hpp @@ -101,10 +101,9 @@ namespace ams::fs { s32 i; for (i = m_position; m_buffer[i] != StringTraits::DirectorySeparator; ++i) { if (m_buffer[i] == StringTraits::NullTerminator) { - if (i == m_position) { - m_position = -1; - return nullptr; - } + char * const ret = (i != m_position) ? m_buffer + m_position : nullptr; + m_position = -1; + return ret; } } diff --git a/libraries/libstratosphere/include/stratosphere/fssystem/fssystem_directory_redirection_filesystem.hpp b/libraries/libstratosphere/include/stratosphere/fssystem/fssystem_directory_redirection_filesystem.hpp index bb0c9318c..5252348c9 100644 --- a/libraries/libstratosphere/include/stratosphere/fssystem/fssystem_directory_redirection_filesystem.hpp +++ b/libraries/libstratosphere/include/stratosphere/fssystem/fssystem_directory_redirection_filesystem.hpp @@ -41,8 +41,8 @@ namespace ams::fssystem { private: Result ResolveFullPath(fs::Path *out, const fs::Path &path) { if (path.IsMatchHead(m_before_dir.GetString(), m_before_dir.GetLength())) { - R_TRY(out->InitializeWithFormat("%s%s", m_after_dir.GetString(), path.GetString() + m_before_dir.GetLength())); - R_TRY(out->Normalize(fs::PathFlags{})); + R_TRY(out->Initialize(m_after_dir)); + R_TRY(out->AppendChild(path)); } else { R_TRY(out->Initialize(path)); }