pxe_menu_to_menu() numbers each extlinux/PXE label with sprintf() into
char num[4]. That buffer holds at most three digits plus NUL, so the
1000th label writes one byte past num. On 32-bit, name sits immediately
after num, so the overflow corrupts the name pointer and the menu prints
a corrupted label. On 64-bit, alignment padding absorbs that extra byte,
so the overflow is not visible in the printed name.
Enlarge num to 12 bytes so a full decimal int fits, and use snprintf()
with sizeof(num) so the write cannot overflow if the count grows
further.
Fixes: 32d2ffe7316b ("pxe: simplify menu display and selection")
Signed-off-by: Suraj Kakade <[email protected]>
---
boot/pxe_utils.c | 2 +-
include/pxe_utils.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/boot/pxe_utils.c b/boot/pxe_utils.c
index 8c1310dabeb..ecea2ed74d0 100644
--- a/boot/pxe_utils.c
+++ b/boot/pxe_utils.c
@@ -1572,7 +1572,7 @@ static struct menu *pxe_menu_to_menu(struct pxe_menu *cfg)
list_for_each(pos, &cfg->labels) {
label = list_entry(pos, struct pxe_label, list);
- sprintf(label->num, "%d", i++);
+ snprintf(label->num, sizeof(label->num), "%d", i++);
if (menu_item_add(m, label->num, label) != 1) {
menu_destroy(m);
return NULL;
diff --git a/include/pxe_utils.h b/include/pxe_utils.h
index 0378f2889f7..7365a8787b2 100644
--- a/include/pxe_utils.h
+++ b/include/pxe_utils.h
@@ -39,7 +39,7 @@
* list - lets these form a list, which a pxe_menu struct will hold.
*/
struct pxe_label {
- char num[4];
+ char num[12];
char *name;
char *menu;
char *kernel_label;
--
2.43.7
