On 2026-08-31T14:25:38, Aristo Chen <[email protected]> wrote: > bootstd: rauc: Reject slot names that do not fit the env-var name buffer > > The names of the "BOOT_<slot>_LEFT" environment variables are built with > sprintf() into fixed 42-byte stack buffers, and the "rauc.slot=<slot>" > kernel argument into a 64-byte one. The slot names come from the > BOOT_ORDER environment variable in find_active_slot() and > distro_rauc_boot(), and from CONFIG_BOOTMETH_RAUC_BOOT_ORDER in > distro_rauc_read_bootflow() and the reset-all-tries path. Nothing limits > their length, so a slot name longer than 32 characters writes past the > end of the buffer, and even a 32-character one overflows it by the NUL > terminator. > > The BOOT_ORDER entries are checked against the configured slots when the > bootflow is scanned, but the variable is read again when the bootflow is > booted, so changing it in between (e.g. from the command line) reaches > the unchecked sprintf() calls. > > Build the variable names through a small helper that uses snprintf() and > rejects slot names which do not fit, size the buffer for a 32-character > slot name plus NUL, and use snprintf() for the kernel argument as well. > Its slot name has passed the same check by then, so it always fits. > > Fixes: 7e5c2c782fb9 ("bootstd: Add implementation for bootmeth rauc") > Signed-off-by: Aristo Chen <[email protected]> > > boot/bootmeth_rauc.c | 42 +++++++++++++++++++++++++++++++++++------- > 1 file changed, 35 insertions(+), 7 deletions(-)
Reviewed-by: Simon Glass <[email protected]>
