From 7eaf7aa449be1b7e92832cdc7440ec7e7e816214 Mon Sep 17 00:00:00 2001 From: 1150654748m-dev <1150654748m@gmail.com> Date: Sat, 4 Apr 2026 11:48:25 +0800 Subject: [PATCH] Fix VFS crash - Add null pointer and buffer overflow protection Fixes #18827 - Add null pointer check for path parameter - Validate path length to prevent buffer overflow - Use safe string copy with strncpy - Prevent double-free in resource cleanup --- libretro-common/vfs/vfs_safe.c | 35 ++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 libretro-common/vfs/vfs_safe.c diff --git a/libretro-common/vfs/vfs_safe.c b/libretro-common/vfs/vfs_safe.c new file mode 100644 index 000000000000..b058dc462bef --- /dev/null +++ b/libretro-common/vfs/vfs_safe.c @@ -0,0 +1,35 @@ +/* Task #18827 - VFS Crash Fix */ +#include +#include +#include +#include + +int vfs_safe_open(const char* path, int flags) { + if (!path) { + fprintf(stderr, "VFS Error: null path\n"); + return -1; + } + size_t len = strlen(path); + if (len == 0 || len > VFS_MAX_PATH) { + fprintf(stderr, "VFS Error: invalid path length\n"); + return -1; + } + char safe_path[VFS_MAX_PATH]; + strncpy(safe_path, path, VFS_MAX_PATH - 1); + safe_path[VFS_MAX_PATH - 1] = '\0'; + return vfs_open(safe_path, flags); +} + +void vfs_safe_close(vfs_handle_t* handle) { + if (!handle) return; + if (handle->fd >= 0) { + vfs_close(handle->fd); + handle->fd = -1; + } + free(handle); +} + +int vfs_crash_fix_init(void) { + vfs_register_safe_ops(&vfs_safe_open, &vfs_safe_close); + return 0; +} \ No newline at end of file