On Fri, 10 Jul 2026 20:52:59 +0530, Naveen Kumar Chaudhary wrote:
> pstore_save() writes four different filenames into a fixed 256-byte
> stack buffer 'path' using sprintf() with "%s" fed from argv[3] (the
> user-supplied mount directory). The U-Boot command line buffer
> (CONFIG_SYS_CBSIZE) is typically 1024 or 2048 bytes, so a directory
> path in argv[3] can easily exceed 240 characters and overflow 'path',
> corrupting the surrounding stack frame including the return address.
>
> [...]
Applied to u-boot/main, thanks!
[1/1] cmd: pstore: bound path formatting with snprintf to avoid stack overflow
commit: 0ccd0a939d7d20c5a754a88c52450533932851a1
--
Tom
