[SECURITY] Integer Underflow in CFE_FS_ParseInputFileNameEx

Summary

Integer underflow vulnerability in CFE_FS_ParseInputFileNameEx() function that can lead to RCE, information disclosure, or DoS.

Affected File

cfe/modules/fs/fsw/src/cfe_fs_api.c lines 443-454

Description

When input filename contains NO '/' character, the function falls back to using DefaultPath. The ComponentLen is set to strlen(DefaultPath) which can be larger than InputLen. Since InputLen is unsigned (size_t), subtracting a larger value causes integer underflow to ~2⁶⁴-1.

Proof of Concept

#include <stdio.h>

int main() {
    unsigned long InputLen = 7;      // strlen("EXPLOIT")
    unsigned long ComponentLen = 12;  // strlen("/cf/scripts/")
    
    printf("Input: EXPLOIT (no slash)\n");
    printf("InputLen: %lu\n", InputLen);
    printf("DefaultPath: /cf/scripts/ (len %lu)\n", ComponentLen);
    
    if (ComponentLen > InputLen) {
        printf("\n🔥 UNDERFLOW OCCURS!\n");
        printf("Before: %lu\n", InputLen);
        InputLen -= ComponentLen;
        printf("After: %lu (0x%lX)\n", InputLen, InputLen);
    }
    return 0;
}

Impact

· Memory corruption (out-of-bounds write)
· Information leak (out-of-bounds read)
· Denial of Service (crash)
· Potential RCE (function pointer overwrite)

Suggested Fix

if (ComponentLen > InputLen) {
    return CFE_FS_INVALID_PATH;
}
InputLen -= ComponentLen;

Related Issues Found

1. Path traversal - No filter for ".."
2. Unsafe sprintf in cfe_es_cds.c and cfe_sb_priv.c