This series fixes a stack buffer overflow in the RAUC bootmeth. The
"BOOT_<slot>_LEFT" environment variable names are built with sprintf()
into fixed 42-byte stack buffers, so a slot name longer than 32
characters from BOOT_ORDER or CONFIG_BOOTMETH_RAUC_BOOT_ORDER writes
past the end of the buffer, and even a 32-character name overflows it by
the NUL terminator.
Patch 1 builds the names through a helper that rejects slot names which
do not fit. Patch 2 adds a regression test covering both sides of the
new length limit.
This series is based on next, since it builds on the recently merged
"bootstd: Fix crashes and memory leaks on scan/boot error paths" series
and its bootflow_rauc test.
Aristo Chen (2):
bootstd: rauc: Reject slot names that do not fit the env-var name
buffer
test: boot: Check that rauc rejects over-long slot names
boot/bootmeth_rauc.c | 42 +++++++++++++++++++++++++++++++++++-------
test/boot/bootflow.c | 23 +++++++++++++++++++++++
2 files changed, 58 insertions(+), 7 deletions(-)
base-commit: 856a00aeb61c1d4e7825257e54219599f8e34a6c
--
2.43.0
