From: Kevin Day <Kevin@kevux.org>
Date: Mon, 9 Nov 2026 00:54:47 +0000 (-0600)
Subject: Security: Early resizing before pointer is properly allocated in fss_write pipe handling.
X-Git-Url: https://www.git.kevux.org/?a=commitdiff_plain;h=d94236b485dda6eb63bab930fda9e7a3fd2476c0;p=fll

Security: Early resizing before pointer is properly allocated in fss_write pipe handling.

The array address is being capture prior to the resize that ensures the memory exists.
This can result in invalid memory access.
---

diff --git a/level_3/fss_write/c/main/fss_write.c b/level_3/fss_write/c/main/fss_write.c
index f3b3e480b..8aa97951f 100644
--- a/level_3/fss_write/c/main/fss_write.c
+++ b/level_3/fss_write/c/main/fss_write.c
@@ -124,15 +124,11 @@ extern "C" {
     const f_number_unsigned_t used_contentss = main->setting.contentss.used;
     const f_number_unsigned_t used_ignoress = main->setting.ignoress.used;
 
-    main->setting.object = &main->setting.objects.array[used_objects];
-    main->setting.contents = &main->setting.contentss.array[used_contentss];
-    main->setting.ignores = &main->setting.ignoress.array[used_ignoress];
-
     // 0x0 = nothing printed, 0x1 = something printed, 0x2 = ignore enabled, 0x4 = added Content for Object.
-    uint8_t flag = 0;
+    uint8_t flag = 0x0;
 
     // 0x0 = start new object/content set, 0x1 = processing object, 0x2 = processing content, 0x3 = end object/content set.
-    uint8_t state = 0;
+    uint8_t state = 0x0;
 
     // This is processed in a single set, so there is only ever one Object added.
     main->setting.state.status = f_memory_array_increase(main->setting.state.step_small, sizeof(f_string_dynamic_t), (void **) &main->setting.objects.array, &main->setting.objects.used, &main->setting.objects.size);
@@ -143,6 +139,8 @@ extern "C" {
       return;
     }
 
+    main->setting.object = &main->setting.objects.array[used_objects];
+
     // This is processed in a single set, so there is only ever one Content added.
     main->setting.state.status = f_memory_array_increase(main->setting.state.step_small, sizeof(f_string_dynamics_t), (void **) &main->setting.contentss.array, &main->setting.contentss.used, &main->setting.contentss.size);
 
@@ -152,6 +150,8 @@ extern "C" {
       return;
     }
 
+    main->setting.contents = &main->setting.contentss.array[used_contentss];
+
     main->setting.state.status = f_memory_array_increase(main->setting.state.step_small, sizeof(f_string_dynamic_t), (void **) &main->setting.contents->array, &main->setting.contents->used, &main->setting.contents->size);
 
     if (F_status_is_error(main->setting.state.status)) {
@@ -169,6 +169,8 @@ extern "C" {
       return;
     }
 
+    main->setting.ignores = &main->setting.ignoress.array[used_ignoress];
+
     f_status_t status_pipe = F_okay;
 
     f_file_t input = f_file_t_initialize;