On Mon, Aug 31, 2026 at 02:25:38PM +0000, Aristo Chen wrote: > This series fixes a stack buffer overflow in the RAUC bootmeth. The > "BOOT_<slot>_LEFT" environment variable names are built with sprintf() > into fixed 42-byte stack buffers, so a slot name longer than 32 > characters from BOOT_ORDER or CONFIG_BOOTMETH_RAUC_BOOT_ORDER writes > past the end of the buffer, and even a 32-character name overflows it by > the NUL terminator. > > Patch 1 builds the names through a helper that rejects slot names which > do not fit. Patch 2 adds a regression test covering both sides of the > new length limit. > > This series is based on next, since it builds on the recently merged > "bootstd: Fix crashes and memory leaks on scan/boot error paths" series > and its bootflow_rauc test.
I'm hoping for some tags from the RAUC folks on this, thanks! -- Tom
signature.asc
Description: PGP signature
