From 5e94d4482bf4a7aa40fd89700ffca3be9ca2d9ee Mon Sep 17 00:00:00 2001 From: wangjianyu3 Date: Sat, 7 Jun 2025 23:11:32 +0800 Subject: [PATCH] fs/vfs: check buffer count and pointer for iovec There are iovecs provided by user such as readv(). Signed-off-by: wangjianyu3 --- fs/vfs/fs_read.c | 12 ++++++++++++ fs/vfs/fs_write.c | 12 ++++++++++++ 2 files changed, 24 insertions(+) diff --git a/fs/vfs/fs_read.c b/fs/vfs/fs_read.c index 0c99509cba..14f825fd6c 100644 --- a/fs/vfs/fs_read.c +++ b/fs/vfs/fs_read.c @@ -164,6 +164,18 @@ ssize_t file_readv(FAR struct file *filep, DEBUGASSERT(filep); inode = filep->f_inode; + /* Check buffer count and pointer for iovec */ + + if (iovcnt == 0) + { + return 0; + } + + if (iov == NULL) + { + return -EFAULT; + } + /* Are all iov_base accessible? */ for (ret = 0; ret < iovcnt; ret++) diff --git a/fs/vfs/fs_write.c b/fs/vfs/fs_write.c index 896e256040..a18727a9c9 100644 --- a/fs/vfs/fs_write.c +++ b/fs/vfs/fs_write.c @@ -153,6 +153,18 @@ ssize_t file_writev(FAR struct file *filep, return -EACCES; } + /* Check buffer count and pointer for iovec */ + + if (iovcnt == 0) + { + return 0; + } + + if (iov == NULL) + { + return -EFAULT; + } + /* Are all iov_base accessible? */ for (ret = 0; ret < iovcnt; ret++)