Skip to content

Commit

Permalink
Add missing error check
Browse files Browse the repository at this point in the history
In FF_Write a loop is used to write remaining blocks, and breaks are
used to terminate on error. However, these breaks intended to break the
containing do-while. As they do not, on error from FF_BlockWrite,
control would get passed to after the loop, FF_SetCluster would clear
the error, and FF_WritePartial would be called with ulBytesLeft greater
than block size, which is invalid and causes out of bounds memory
writes.

This is fixed by checking the error after the loop and breaking again.
  • Loading branch information
archigup committed Jul 5, 2024
1 parent f834aee commit 95c35e9
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions ff_file.c
Original file line number Diff line number Diff line change
Expand Up @@ -2447,6 +2447,11 @@ int32_t FF_Write( FF_FILE * pxFile,
}
}

if( FF_isERR( xError ) )
{
break;
}

/*---------- Write (memcpy) Remaining Bytes */
if( ulBytesLeft == 0 )
{
Expand Down

0 comments on commit 95c35e9

Please sign in to comment.