Some reports of suspected vulnerabilities

[firmianay]

hi, great project!
I found that in the lv_fs_if/lv_fs_pc.c file, there is no length limit for "oldname" and "newname", and sprintf them directly into a fixed-length stack buffer, which may lead to overflow. Although the filename length is limited to 255 bytes on linux, the path length can be up to 4096 bytes.

/**
 * Rename a file
 * @param drv pointer to a driver where this function belongs
 * @param oldname path to the file
 * @param newname path with the new name
 * @return LV_FS_RES_OK or any error from 'fs_res_t'
 */
static lv_fs_res_t fs_rename (lv_fs_drv_t * drv, const char * oldname, const char * newname)
{
	(void) drv;		/*Unused*/
	static char new[512];
	static char old[512];

	sprintf(old, LV_FS_PC_PATH "/%s", oldname);
	sprintf(new, LV_FS_PC_PATH "/%s", newname);

	int r = rename(old, new);

	if(r == 0) return LV_FS_RES_OK;
	else return LV_FS_RES_UNKNOWN;
}

[firmianay]

There is a off-by-one overflow in ble_gatts_lcl.c since strcat will writing a new null-terminator at the end. Annotation has been marked:

#define BLE_CHR_FLAGS_STR_LEN 180

static char *
ble_gatts_flags_to_str(uint16_t flags, char *buf,
                       const char * const *names)
{
    int bit;
    bool non_empty = false;
    size_t length = 0;

    buf[0] = '\0';    // buf[180]
    strcpy(buf, "[");
    length += 1;
    for (bit = 0; names[bit]; ++bit) {
        if (flags & (1 << bit)) {
            length += strlen(names[bit]);   // strlen(buf)=168, length=168, strlen(names[bit])=10
                                            // 168 + 10 = 178
            if (length + 1 >= BLE_CHR_FLAGS_STR_LEN) {  // 178 + 1 < 180
                return buf;
            }
            if (non_empty) {
                strcat(buf, "|");       // strlen(buf)=169
                length += 1;            // 178 + 1 = 179
            }
            strcat(buf, names[bit]);    // strlen(buf)=179
            non_empty = true;
        }
    }
    strcat(buf, "]");                   // strlen(buf)=180 -> buf[180] = '\0'
    return buf;
}