On 2026-10-01T03:59:57, Suraj Kakade <[email protected]> wrote: > boot: pxe_utils: Fix buffer overflow in pxe_label.num > > pxe_menu_to_menu() numbers each extlinux/PXE label with sprintf() into > char num[4]. That buffer holds at most three digits plus NUL, so the > 1000th label writes one byte past num. On 32-bit, name sits immediately > after num, so the overflow corrupts the name pointer and the menu prints > a corrupted label. On 64-bit, alignment padding absorbs that extra byte, > so the overflow is not visible in the printed name. > > Enlarge num to 12 bytes so a full decimal int fits, and use snprintf() > with sizeof(num) so the write cannot overflow if the count grows > further. > > Fixes: 32d2ffe7316b ("pxe: simplify menu display and selection") > Signed-off-by: Suraj Kakade <[email protected]> > > boot/pxe_utils.c | 2 +- > include/pxe_utils.h | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-)
Reviewed-by: Simon Glass <[email protected]>
