On 01/10/2026 05:41, Suraj Kakade wrote:
> parse_label() takes an initrd= filename embedded in an append line
> and computes its length as strchr(s, ' ') - s. When initrd= is the
> last token, the append line ends at newline, so there is no blank
> after the filename. strchr() returns NULL, the pointer subtraction
> is not a length, and malloc() and strncpy() use an invalid size.
>
> If strchr() finds no space, use strlen(s) as the length.
>
> Fixes: 34bd23e42f3b ("pxe: parse initrd file from append string")
> Signed-off-by: Suraj Kakade <[email protected]>
> ---
> boot/pxe_utils.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/boot/pxe_utils.c b/boot/pxe_utils.c
> index 8c1310dabeb..d4c57ff11f9 100644
> --- a/boot/pxe_utils.c
> +++ b/boot/pxe_utils.c
> @@ -1285,6 +1285,7 @@ static int parse_label_kernel(char **c, struct
> pxe_label *label)
> static int parse_label(char **c, struct pxe_menu *cfg)
> {
> struct token t;
> + char *end;
> int len;
> char *s = *c;
> struct pxe_label *label;
> @@ -1326,7 +1327,8 @@ static int parse_label(char **c, struct pxe_menu *cfg)
> if (!s)
> break;
> s += 7;
> - len = (int)(strchr(s, ' ') - s);
> + end = strchr(s, ' ');
How about len = strcspn(s, " \t"); instead? This would naturally
handle both â â and â\tâ, like the parser does when tokenizing the input,
and avoid the need for explicit pointer arithmetic.
> + len = end ? (int)(end - s) : (int)strlen(s);
> label->initrd = malloc(len + 1);
> strncpy(label->initrd, s, len);
> label->initrd[len] = '\0';
Thanks,
--
Jerome
