MEMORY LEAK AND FREEZE IN ss_fs_chg_add()

[edbek]

MEMORY LEAK AND FREEZE IN ss_fs_chg_add() (fs_chg.c)

File:
onomondo-uicc/src/softsim/uicc/fs_chg.c:187

Code:
c
184: fid |= *files;
185: files++;
186: if ((fid & 0xFF00) != 0x3F00)
187: return -EINVAL; // <-- 💥 DIRECT RETURN WITHOUT PACKET DROP OR NOTIFICATION!

💥 Root of the problem:
Incorrect loop exit condition (

fs_chg.c:199
): ss_fs_chg_add() uses while ((fid & 0xFF00) != 0x3F00);. The pack_path() function adds an exact terminator of 0x3F00 to the end of each path. Because of the & 0xFF00 mask, the loop stops at any child directory (e.g., 0x3F20), mistaking it for the end of the path! Other file functions (e.g., ss_fs_chg_len() on line 255) use the correct exact check: while (fid != 0x3F00);.

Leftover corrupted context on error (

fs_chg.c:188
): If the list structure is corrupted (e.g., due to a Flash/RAM failure), ss_fs_chg_add() returns -EINVAL but leaves the filelist array in a half-written state. The next time ss_fs_chg_dump() is called, the code hits garbage bytes and enters an infinite loop.

🛠️ Suggested solution:
Fix the path termination condition: Replace the mask (fid & 0xFF00) != 0x3F00 with an exact match against the terminator: fid != 0x3F00 (as in ss_fs_chg_len).

Add crash-safe buffer flushing: When an invalid FID is detected or the SS_FS_CHG_BUF_SIZE array is out of bounds, reset the list header filelist[0] = 0; (reset the corrupted list) before returning -EINVAL.

c
/* Fixed fragment of path element traversal in ss_fs_chg_add /
do {
if (files - filelist >= SS_FS_CHG_BUF_SIZE - 1) {
filelist[0] = 0; / Reset the corrupted list to avoid hangs */
return -EINVAL;
}
fid = *files << 8;
files++;
fid |= files;
files++;
} while (fid != 0x3F00); / Precise end-of-path terminator */