From 2f2bfa9a3c9239996491e8de49b49d949d27ae4f Mon Sep 17 00:00:00 2001
From: Rongsong Shen <rshen@shenrs.eu>
Date: Wed, 13 May 2026 15:53:40 +0000
Subject: [PATCH] fix: conf_trim early-return on missing current pointer; check
 fsync/fseek return values

---
 src/controller/config_repl.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/src/controller/config_repl.c b/src/controller/config_repl.c
index 62e784f..06f08eb 100644
--- a/src/controller/config_repl.c
+++ b/src/controller/config_repl.c
@@ -137,7 +137,11 @@ int conf_save_config(myconf_t *myconf, const uint8_t *bytes, size_t len,
         unlink(ptr_tmp);
         return -EIO;
     }
-    fsync(fd);
+    if (fsync(fd) != 0) {
+        close(fd);
+        unlink(ptr_tmp);
+        return -EIO;
+    }
     close(fd);
     if (rename(ptr_tmp, ptr_path) != 0) {
         unlink(ptr_tmp);
@@ -185,7 +189,10 @@ int conf_read_raw(const char *conffile, uint8_t **bytes, size_t *len)
         fclose(f);
         return -EIO;
     }
-    fseek(f, 0, SEEK_SET);
+    if (fseek(f, 0, SEEK_SET) != 0) {
+        fclose(f);
+        return -EIO;
+    }
 
     if (sz == 0) {
         fclose(f);
@@ -285,9 +292,12 @@ void conf_trim_old_versions(const char *workdir, int keep_n)
     char conf_dir[4096];
     make_conf_dir(workdir, conf_dir, sizeof(conf_dir));
 
-    /* Read current pointer to protect it */
+    /* Read current pointer to protect it from deletion */
     char current_name[256] = {0};
-    conf_read_current_filename(workdir, current_name, sizeof(current_name));
+    if (conf_read_current_filename(workdir, current_name, sizeof(current_name)) != 0) {
+        /* No current pointer — nothing safe to trim without risking deleting the active file */
+        return;
+    }
 
     ver_entry_t entries[256];
     int n = 0;