react-native-update 10.55.1 → 10.56.0

package/cpp/patch_core/patch_core.cpp

@@ -3,13 +3,18 @@
 #include "digest.h"
 
 #include <cerrno>
+#include <cstdint>
 #include <cstdio>
 #include <cstring>
 #include <dirent.h>
+#include <fcntl.h>
+#include <sys/mman.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
 
+#include <algorithm>
+#include <limits>
 #include <vector>
 
 #include "hbc_transform.h"
@@ -30,6 +35,12 @@ namespace {
 
 constexpr size_t kCopyBufferSize = 16 * 1024;
 
+// Directory walkers recurse once per nesting level. A hostile archive can nest
+// thousands of directories while staying well inside the entry-count cap, so
+// bound the depth explicitly instead of letting the stack overflow (mirrors
+// flowjson::kMaxDepth). Real bundles nest a handful of levels.
+constexpr int kMaxDirectoryDepth = 64;
+
 class HdiffBundlePatcher final : public BundlePatcher {
  public:
   Status Apply(
@@ -124,28 +135,31 @@ Status EnsureDirectory(const std::string& path) {
   if (path.empty()) {
     return Status::Ok();
   }
-  if (PathExists(path)) {
-    if (IsDirectory(path)) {
-      return Status::Ok();
-    }
-    return Status::Error("Expected directory path: " + path);
-  }
-
-  const std::string parent = Dirname(path);
-  if (!parent.empty()) {
-    Status parent_status = EnsureDirectory(parent);
-    if (!parent_status) {
-      return parent_status;
+  // Walk the components left to right instead of recursing on the parent:
+  // manifest paths are attacker-controlled and may carry thousands of
+  // segments.
+  size_t pos = 0;
+  while (pos <= path.size()) {
+    size_t slash = path.find('/', pos);
+    if (slash == std::string::npos) {
+      slash = path.size();
+    }
+    const std::string prefix = path.substr(0, slash);
+    if (!prefix.empty()) {
+      if (PathExists(prefix)) {
+        if (!IsDirectory(prefix)) {
+          return Status::Error("Expected directory path: " + prefix);
+        }
+      } else if (mkdir(prefix.c_str(), 0755) != 0 && errno != EEXIST) {
+        return MakeErrnoStatus("Failed to create directory " + prefix);
+      }
     }
-  }
-
-  if (mkdir(path.c_str(), 0755) != 0 && errno != EEXIST) {
-    return MakeErrnoStatus("Failed to create directory " + path);
+    pos = slash + 1;
   }
   return Status::Ok();
 }
 
-Status RemovePathRecursively(const std::string& path) {
+Status RemovePathRecursively(const std::string& path, int depth = 0) {
   struct stat st;
   if (lstat(path.c_str(), &st) != 0) {
     if (errno == ENOENT) {
@@ -155,6 +169,9 @@ Status RemovePathRecursively(const std::string& path) {
   }
 
   if (S_ISDIR(st.st_mode)) {
+    if (depth >= kMaxDirectoryDepth) {
+      return Status::Error("Directory nesting too deep: " + path);
+    }
     DIR* dir = opendir(path.c_str());
     if (!dir) {
       return MakeErrnoStatus("Failed to open directory " + path);
@@ -166,7 +183,8 @@ Status RemovePathRecursively(const std::string& path) {
       if (name == "." || name == "..") {
         continue;
       }
-      Status remove_status = RemovePathRecursively(JoinPath(path, name));
+      Status remove_status =
+          RemovePathRecursively(JoinPath(path, name), depth + 1);
       if (!remove_status) {
         closedir(dir);
         return remove_status;
@@ -191,20 +209,26 @@ Status ReadFileBytes(const std::string& path, std::vector<uint8_t>* out) {
   if (file == nullptr) {
     return MakeErrnoStatus("Failed to open file for reading " + path);
   }
-  if (fseek(file, 0, SEEK_END) != 0) {
+  // fstat rather than fseek/ftell: ftell returns a 32-bit long on the 32-bit
+  // ABIs (armeabi-v7a, x86), and the regular-file check keeps directories and
+  // devices out.
+  struct stat st;
+  if (fstat(fileno(file), &st) != 0) {
     fclose(file);
-    return MakeErrnoStatus("Failed to seek file " + path);
+    return MakeErrnoStatus("Failed to size file " + path);
   }
-  const long size = ftell(file);
-  if (size < 0) {
+  if (!S_ISREG(st.st_mode)) {
     fclose(file);
-    return MakeErrnoStatus("Failed to size file " + path);
+    return Status::Error("Not a regular file: " + path);
   }
-  if (fseek(file, 0, SEEK_SET) != 0) {
+  if (st.st_size < 0 ||
+      static_cast<uint64_t>(st.st_size) >
+          static_cast<uint64_t>(std::numeric_limits<size_t>::max() / 2)) {
     fclose(file);
-    return MakeErrnoStatus("Failed to rewind file " + path);
+    return Status::Error("File too large to load: " + path);
   }
-  out->resize(static_cast<size_t>(size));
+  const size_t size = static_cast<size_t>(st.st_size);
+  out->resize(size);
   if (size > 0 &&
       fread(out->data(), 1, out->size(), file) != out->size()) {
     fclose(file);
@@ -214,6 +238,20 @@ Status ReadFileBytes(const std::string& path, std::vector<uint8_t>* out) {
   return Status::Ok();
 }
 
+// fflush + fsync so payload bytes are durable before the caller's two-phase
+// rename: a power cut must not leave a complete-looking version directory
+// with a truncated bundle. EINVAL means the descriptor cannot be synced (some
+// pseudo filesystems) and is not an error.
+Status SyncFile(FILE* file, const std::string& path) {
+  if (fflush(file) != 0) {
+    return MakeErrnoStatus("Failed to flush file " + path);
+  }
+  if (fsync(fileno(file)) != 0 && errno != EINVAL) {
+    return MakeErrnoStatus("Failed to sync file " + path);
+  }
+  return Status::Ok();
+}
+
 Status WriteFileBytes(const std::string& path, const std::vector<uint8_t>& data) {
   FILE* file = fopen(path.c_str(), "wb");
   if (file == nullptr) {
@@ -224,6 +262,12 @@ Status WriteFileBytes(const std::string& path, const std::vector<uint8_t>& data)
     remove(path.c_str());
     return Status::Error("Failed to write file " + path);
   }
+  Status sync_status = SyncFile(file, path);
+  if (!sync_status) {
+    fclose(file);
+    remove(path.c_str());
+    return sync_status;
+  }
   if (fclose(file) != 0) {
     remove(path.c_str());
     return MakeErrnoStatus("Failed to flush file " + path);
@@ -231,42 +275,10 @@ Status WriteFileBytes(const std::string& path, const std::vector<uint8_t>& data)
   return Status::Ok();
 }
 
-Status CopyFile(const std::string& from, const std::string& to, bool overwrite) {
-  struct stat st;
-  if (stat(from.c_str(), &st) != 0) {
-    return MakeErrnoStatus("Failed to stat source file " + from);
-  }
-  if (!S_ISREG(st.st_mode)) {
-    return Status::Error("Source is not a regular file: " + from);
-  }
-
-  const std::string parent = Dirname(to);
-  Status dir_status = EnsureDirectory(parent);
-  if (!dir_status) {
-    return dir_status;
-  }
-
-  if (PathExists(to)) {
-    if (!overwrite) {
-      return Status::Ok();
-    }
-    Status remove_status = RemovePathRecursively(to);
-    if (!remove_status) {
-      return remove_status;
-    }
-  }
-
-  // Prefer a hard link over copying bytes: unchanged files between versions
-  // are identical, so linking is O(1) per file, writes nothing to flash, and
-  // shares disk blocks. Version directories are immutable once created (patch
-  // outputs are always written as new files), so sharing the inode with the
-  // source is safe. Fall back to a byte copy whenever linking is not possible
-  // (cross-device source such as the installed app bundle, EPERM, EMLINK, or
-  // filesystems without hard-link support).
-  if (!internal::g_disable_hard_links && link(from.c_str(), to.c_str()) == 0) {
-    return Status::Ok();
-  }
-
+// Streams `from` into a fresh `to` through a small buffer: never a hard link
+// (callers that go on to mutate `to` in place rely on that) and never the
+// whole file in memory.
+Status CopyFileBytes(const std::string& from, const std::string& to) {
   FILE* source = std::fopen(from.c_str(), "rb");
   if (!source) {
     return MakeErrnoStatus("Failed to open source file " + from);
@@ -301,12 +313,56 @@ Status CopyFile(const std::string& from, const std::string& to, bool overwrite)
   }
 
   std::fclose(source);
+  Status sync_status = SyncFile(destination, to);
+  if (!sync_status) {
+    std::fclose(destination);
+    return sync_status;
+  }
   if (std::fclose(destination) != 0) {
     return MakeErrnoStatus("Failed to close destination file " + to);
   }
   return Status::Ok();
 }
 
+Status CopyFile(const std::string& from, const std::string& to, bool overwrite) {
+  struct stat st;
+  if (stat(from.c_str(), &st) != 0) {
+    return MakeErrnoStatus("Failed to stat source file " + from);
+  }
+  if (!S_ISREG(st.st_mode)) {
+    return Status::Error("Source is not a regular file: " + from);
+  }
+
+  const std::string parent = Dirname(to);
+  Status dir_status = EnsureDirectory(parent);
+  if (!dir_status) {
+    return dir_status;
+  }
+
+  if (PathExists(to)) {
+    if (!overwrite) {
+      return Status::Ok();
+    }
+    Status remove_status = RemovePathRecursively(to);
+    if (!remove_status) {
+      return remove_status;
+    }
+  }
+
+  // Prefer a hard link over copying bytes: unchanged files between versions
+  // are identical, so linking is O(1) per file, writes nothing to flash, and
+  // shares disk blocks. Version directories are immutable once created (patch
+  // outputs are always written as new files), so sharing the inode with the
+  // source is safe. Fall back to a byte copy whenever linking is not possible
+  // (cross-device source such as the installed app bundle, EPERM, EMLINK, or
+  // filesystems without hard-link support).
+  if (!internal::g_disable_hard_links && link(from.c_str(), to.c_str()) == 0) {
+    return Status::Ok();
+  }
+
+  return CopyFileBytes(from, to);
+}
+
 struct DeleteRule {
   std::string path;
   bool directory_hint;
@@ -367,7 +423,8 @@ Status MergeDirectoryRecursively(
     const std::string& source_root,
     const std::string& target_root,
     const std::string& relative_root,
-    const DeleteMatcher& deletes) {
+    const DeleteMatcher& deletes,
+    int depth = 0) {
   DIR* dir = opendir(source_root.c_str());
   if (!dir) {
     if (errno == ENOENT) {
@@ -399,14 +456,18 @@ Status MergeDirectoryRecursively(
 
     const std::string target_path = JoinPath(target_root, name);
     if (S_ISDIR(st.st_mode)) {
+      if (depth >= kMaxDirectoryDepth) {
+        closedir(dir);
+        return Status::Error("Directory nesting too deep: " + source_path);
+      }
       Status dir_status = EnsureDirectory(target_path);
       if (!dir_status) {
         closedir(dir);
         return dir_status;
       }
 
-      Status merge_status =
-          MergeDirectoryRecursively(source_path, target_path, relative_path, deletes);
+      Status merge_status = MergeDirectoryRecursively(
+          source_path, target_path, relative_path, deletes, depth + 1);
       if (!merge_status) {
         closedir(dir);
         return merge_status;
@@ -445,10 +506,76 @@ const BundlePatcher& DefaultBundlePatcher() {
 
 namespace {
 
+// Applies T (or T⁻¹) to a file in place through a shared mapping, so a
+// 10–50 MB bundle never has to be read into an anonymous heap buffer: the
+// pages are backed by the file itself and can be written back and evicted
+// under memory pressure. Falls back to read → transform → write when the
+// mapping is unavailable. On a rejected transform the bytes are left as they
+// were (TransformHbcInPlace never partially mutates).
+Status TransformFileInPlace(
+    const std::string& path,
+    const hbc::HbcLayoutDesc& layout,
+    bool inverse) {
+  const char* failure = inverse
+      ? "hbcTransform inverse failed on patched bundle"
+      : "hbcTransform failed on origin bundle";
+
+  const int fd = open(path.c_str(), O_RDWR);
+  if (fd < 0) {
+    return MakeErrnoStatus("Failed to open bundle for transform " + path);
+  }
+  struct stat st;
+  if (fstat(fd, &st) != 0) {
+    close(fd);
+    return MakeErrnoStatus("Failed to size bundle " + path);
+  }
+  void* mapped = MAP_FAILED;
+  size_t size = 0;
+  if (S_ISREG(st.st_mode) && st.st_size > 0 &&
+      static_cast<uint64_t>(st.st_size) <=
+          static_cast<uint64_t>(std::numeric_limits<size_t>::max() / 2)) {
+    size = static_cast<size_t>(st.st_size);
+    mapped = mmap(nullptr, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
+  }
+  if (mapped == MAP_FAILED) {
+    close(fd);
+    std::vector<uint8_t> bytes;
+    Status status = ReadFileBytes(path, &bytes);
+    if (!status) {
+      return status;
+    }
+    if (!hbc::TransformHbcInPlace(bytes.data(), bytes.size(), layout, inverse)) {
+      return Status::Error(failure);
+    }
+    return WriteFileBytes(path, bytes);
+  }
+
+  const bool transformed = hbc::TransformHbcInPlace(
+      static_cast<uint8_t*>(mapped), size, layout, inverse);
+  const bool synced = msync(mapped, size, MS_SYNC) == 0;
+  const int sync_errno = errno;
+  munmap(mapped, size);
+  const bool fsynced = fsync(fd) == 0 || errno == EINVAL;
+  const int fsync_errno = errno;
+  close(fd);
+  if (!transformed) {
+    return Status::Error(failure);
+  }
+  if (!synced) {
+    return MakeErrnoStatus("Failed to sync transformed bundle " + path, sync_errno);
+  }
+  if (!fsynced) {
+    return MakeErrnoStatus("Failed to sync transformed bundle " + path, fsync_errno);
+  }
+  return Status::Ok();
+}
+
 // 变换域 bundle patch:T(origin) → hpatch → T⁻¹。
 // 元数据/变换的任何失败都返回错误——调用方沿既有失败路径回退整包;
 // 绝不能忽略元数据直接 hpatch(会产出损坏 bundle,虽然最终 hash 校验
 // 也会拦住,但应在此处快速失败)。
+// 两次变换都在临时文件上原地完成(见 TransformFileInPlace),整个流程
+// 端到端不把 bundle 整体读进内存。
 Status ApplyBundlePatchWithHbcTransform(
     const FileSourcePatchOptions& options,
     const BundlePatcher& bundle_patcher) {
@@ -464,26 +591,27 @@ Status ApplyBundlePatchWithHbcTransform(
   std::vector<hbc::HbcSectionDesc> sections_scratch;
   const hbc::HbcLayoutDesc layout = hbc::BuildLayout(meta, &sections_scratch);
 
-  std::vector<uint8_t> origin;
-  Status status = ReadFileBytes(options.origin_bundle_path, &origin);
-  if (!status) {
-    return status;
-  }
-  if (!hbc::TransformHbcInPlace(origin.data(), origin.size(), layout, false)) {
-    return Status::Error("hbcTransform failed on origin bundle");
-  }
-
   Status dir_status = EnsureDirectory(Dirname(options.bundle_output_path));
   if (!dir_status) {
     return dir_status;
   }
   const std::string temp_origin = options.bundle_output_path + ".hbct-origin";
   const std::string temp_patched = options.bundle_output_path + ".hbct-patched";
-  status = WriteFileBytes(temp_origin, origin);
+  remove(temp_origin.c_str());
+  remove(temp_patched.c_str());
+
+  // A private byte copy — never a hard link — because the transform mutates
+  // it in place and the origin bundle must stay untouched.
+  Status status = CopyFileBytes(options.origin_bundle_path, temp_origin);
+  if (!status) {
+    remove(temp_origin.c_str());
+    return status;
+  }
+  status = TransformFileInPlace(temp_origin, layout, false);
   if (!status) {
+    remove(temp_origin.c_str());
     return status;
   }
-  origin = std::vector<uint8_t>(); // 及早释放,patch 期间只保留文件副本
 
   Status patch_status =
       bundle_patcher.Apply(temp_origin, options.bundle_patch_path, temp_patched);
@@ -493,23 +621,26 @@ Status ApplyBundlePatchWithHbcTransform(
     return patch_status;
   }
 
-  std::vector<uint8_t> patched;
-  status = ReadFileBytes(temp_patched, &patched);
-  remove(temp_patched.c_str());
+  status = TransformFileInPlace(temp_patched, layout, true);
   if (!status) {
+    remove(temp_patched.c_str());
     return status;
   }
-  if (!hbc::TransformHbcInPlace(patched.data(), patched.size(), layout, true)) {
-    return Status::Error("hbcTransform inverse failed on patched bundle");
-  }
 
   if (PathExists(options.bundle_output_path)) {
     Status remove_status = RemovePathRecursively(options.bundle_output_path);
     if (!remove_status) {
+      remove(temp_patched.c_str());
       return remove_status;
     }
   }
-  return WriteFileBytes(options.bundle_output_path, patched);
+  if (rename(temp_patched.c_str(), options.bundle_output_path.c_str()) != 0) {
+    Status rename_status = MakeErrnoStatus(
+        "Failed to move patched bundle into place " + options.bundle_output_path);
+    remove(temp_patched.c_str());
+    return rename_status;
+  }
+  return Status::Ok();
 }
 
 }  // namespace
@@ -591,6 +722,16 @@ Status CleanupOldEntries(
     const std::string& keep_previous,
     int max_age_days,
     std::time_t now) {
+  return CleanupOldEntries(
+      root_dir, std::vector<std::string>{keep_current, keep_previous},
+      max_age_days, now);
+}
+
+Status CleanupOldEntries(
+    const std::string& root_dir,
+    const std::vector<std::string>& keep_names,
+    int max_age_days,
+    std::time_t now) {
   DIR* dir = opendir(root_dir.c_str());
   if (!dir) {
     if (errno == ENOENT) {
@@ -609,7 +750,8 @@ Status CleanupOldEntries(
     if (name == "." || name == ".." || (!name.empty() && name[0] == '.')) {
       continue;
     }
-    if (name == keep_current || name == keep_previous) {
+    if (std::find(keep_names.begin(), keep_names.end(), name) !=
+        keep_names.end()) {
       continue;
     }
 
@@ -648,6 +790,17 @@ bool IsSafeRelativePath(const std::string& path) {
     if (segment.empty() || segment == "." || segment == "..") {
       return false;
     }
+    for (const char ch : segment) {
+      // Control bytes (NUL above all) are never legitimate in a manifest
+      // path: everything downstream goes through c_str(), so an embedded NUL
+      // would silently truncate "..\0x" to ".." and escape the staging root
+      // (reachable through the HarmonyOS NAPI string bridge, which preserves
+      // NULs). Non-ASCII UTF-8 (>= 0x80) stays allowed.
+      const unsigned char byte = static_cast<unsigned char>(ch);
+      if (byte < 0x20 || byte == 0x7f) {
+        return false;
+      }
+    }
   }
   return true;
 }

package/cpp/patch_core/patch_core.h

@@ -68,6 +68,17 @@ Status ApplyPatchFromFileSource(
     const FileSourcePatchOptions& options,
     const BundlePatcher& bundle_patcher = DefaultBundlePatcher());
 
+// Removes every non-dot entry under root_dir older than max_age_days whose
+// name is not in keep_names. Callers must include every version that may
+// still be in use: the persisted current/last versions AND the version this
+// process booted from (two switches without a restart otherwise evict the
+// running bundle while its on-demand assets are still being served).
+Status CleanupOldEntries(
+    const std::string& root_dir,
+    const std::vector<std::string>& keep_names,
+    int max_age_days,
+    std::time_t now = 0);
+
 Status CleanupOldEntries(
     const std::string& root_dir,
     const std::string& keep_current,

package/cpp/patch_core/patch_core_android.cpp

@@ -1,5 +1,6 @@
 #include <jni.h>
 
+#include <exception>
 #include <string>
 #include <vector>
 
@@ -29,36 +30,45 @@ Java_cn_reactnative_modules_update_DownloadTask_applyPatchFromFileSource(
     jobjectArray copy_tos,
     jobjectArray deletes,
     jstring hbc_transform_meta) {
-  const std::vector<std::string> from_values = JArrayToVector(env, copy_froms);
-  const std::vector<std::string> to_values = JArrayToVector(env, copy_tos);
+  // C++ exceptions (bad_alloc/length_error from input-proportional STL
+  // allocations) must not unwind through the JNI boundary: convert them to a
+  // Java RuntimeException like every other failure of this entry point.
+  try {
+    const std::vector<std::string> from_values = JArrayToVector(env, copy_froms);
+    const std::vector<std::string> to_values = JArrayToVector(env, copy_tos);
 
-  if (from_values.size() != to_values.size()) {
-    ThrowRuntimeException(env, "copy_froms and copy_tos length mismatch");
-    return;
-  }
+    if (from_values.size() != to_values.size()) {
+      ThrowRuntimeException(env, "copy_froms and copy_tos length mismatch");
+      return;
+    }
 
-  pushy::patch::FileSourcePatchOptions options;
-  options.source_root = JStringToString(env, source_root);
-  options.target_root = JStringToString(env, target_root);
-  options.origin_bundle_path = JStringToString(env, origin_bundle_path);
-  options.bundle_patch_path = JStringToString(env, bundle_patch_path);
-  options.bundle_output_path = JStringToString(env, bundle_output_path);
-  options.merge_source_subdir = JStringToString(env, merge_source_subdir);
-  options.enable_merge = enable_merge == JNI_TRUE;
-  options.bundle_hbc_transform_meta = JStringToString(env, hbc_transform_meta);
+    pushy::patch::FileSourcePatchOptions options;
+    options.source_root = JStringToString(env, source_root);
+    options.target_root = JStringToString(env, target_root);
+    options.origin_bundle_path = JStringToString(env, origin_bundle_path);
+    options.bundle_patch_path = JStringToString(env, bundle_patch_path);
+    options.bundle_output_path = JStringToString(env, bundle_output_path);
+    options.merge_source_subdir = JStringToString(env, merge_source_subdir);
+    options.enable_merge = enable_merge == JNI_TRUE;
+    options.bundle_hbc_transform_meta = JStringToString(env, hbc_transform_meta);
 
-  for (size_t index = 0; index < from_values.size(); ++index) {
-    options.manifest.copies.push_back(pushy::patch::CopyOperation{
-        from_values[index],
-        to_values[index],
-    });
-  }
-  options.manifest.deletes = JArrayToVector(env, deletes);
+    for (size_t index = 0; index < from_values.size(); ++index) {
+      options.manifest.copies.push_back(pushy::patch::CopyOperation{
+          from_values[index],
+          to_values[index],
+      });
+    }
+    options.manifest.deletes = JArrayToVector(env, deletes);
 
-  const pushy::patch::Status status =
-      pushy::patch::ApplyPatchFromFileSource(options);
-  if (!status.ok) {
-    ThrowRuntimeException(env, status.message);
+    const pushy::patch::Status status =
+        pushy::patch::ApplyPatchFromFileSource(options);
+    if (!status.ok) {
+      ThrowRuntimeException(env, status.message);
+    }
+  } catch (const std::exception& error) {
+    ThrowRuntimeException(env, error.what());
+  } catch (...) {
+    ThrowRuntimeException(env, "Unexpected native exception in applyPatchFromFileSource");
   }
 }
 
@@ -70,12 +80,18 @@ Java_cn_reactnative_modules_update_DownloadTask_cleanupOldEntries(
     jstring keep_current,
     jstring keep_previous,
     jint max_age_days) {
-  const pushy::patch::Status status = pushy::patch::CleanupOldEntries(
-      JStringToString(env, root_dir),
-      JStringToString(env, keep_current),
-      JStringToString(env, keep_previous),
-      static_cast<int>(max_age_days));
-  if (!status.ok) {
-    ThrowRuntimeException(env, status.message);
+  try {
+    const pushy::patch::Status status = pushy::patch::CleanupOldEntries(
+        JStringToString(env, root_dir),
+        JStringToString(env, keep_current),
+        JStringToString(env, keep_previous),
+        static_cast<int>(max_age_days));
+    if (!status.ok) {
+      ThrowRuntimeException(env, status.message);
+    }
+  } catch (const std::exception& error) {
+    ThrowRuntimeException(env, error.what());
+  } catch (...) {
+    ThrowRuntimeException(env, "Unexpected native exception in cleanupOldEntries");
   }
 }