This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 2de40067bcfe848f298aa4c19f146f2166bbd99b Author: Marco Casaroli <[email protected]> AuthorDate: Thu Nov 5 06:51:56 2026 +0100 libs/libc/stream: Limit the conversion length in lib_bsprintf(). lib_bsprintf() copies a conversion to a buffer of 64 bytes, without a limit, and each "*" adds the digits of an int. "%" and 100 digits wrote past the buffer on the stack. End the output at a conversion that does not fit. Part of https://github.com/apache/nuttx/issues/21467 Assisted-by: Claude Code:claude-opus-5-5 Signed-off-by: Marco Casaroli <[email protected]> --- libs/libc/stream/lib_libbsprintf.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/libs/libc/stream/lib_libbsprintf.c b/libs/libc/stream/lib_libbsprintf.c index d7cf54f486e..17344b96471 100644 --- a/libs/libc/stream/lib_libbsprintf.c +++ b/libs/libc/stream/lib_libbsprintf.c @@ -84,6 +84,15 @@ int lib_bsprintf(FAR struct lib_outstream_s *s, FAR const IPTR char *fmt, memset(fmtstr, 0, sizeof(fmtstr)); } + /* A conversion that does not fit ends the output. The space is for + * this character, or for the digits and the sign of a "*". + */ + + if (len >= sizeof(fmtstr) - 12) + { + break; + } + var = (FAR void *)(data + offset); fmtstr[len++] = c;
