Hi Suraj,
On Thu, Oct 1, 2026 at 7:41 AM Suraj Kakade
<[email protected]> wrote:
>
> parse_label() takes an initrd= filename embedded in an append line
> and computes its length as strchr(s, ' ') - s. When initrd= is the
> last token, the append line ends at newline, so there is no blank
> after the filename. strchr() returns NULL, the pointer subtraction
> is not a length, and malloc() and strncpy() use an invalid size.
>
> If strchr() finds no space, use strlen(s) as the length.
>
> Fixes: 34bd23e42f3b ("pxe: parse initrd file from append string")
> Signed-off-by: Suraj Kakade <[email protected]>
> ---
> boot/pxe_utils.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/boot/pxe_utils.c b/boot/pxe_utils.c
> index 8c1310dabeb..d4c57ff11f9 100644
> --- a/boot/pxe_utils.c
> +++ b/boot/pxe_utils.c
> @@ -1285,6 +1285,7 @@ static int parse_label_kernel(char **c, struct
> pxe_label *label)
> static int parse_label(char **c, struct pxe_menu *cfg)
> {
> struct token t;
> + char *end;
> int len;
> char *s = *c;
> struct pxe_label *label;
> @@ -1326,7 +1327,8 @@ static int parse_label(char **c, struct pxe_menu *cfg)
> if (!s)
> break;
> s += 7;
> - len = (int)(strchr(s, ' ') - s);
> + end = strchr(s, ' ');
> + len = end ? (int)(end - s) : (int)strlen(s);
Looks like your base tree is behind next. Have you tried 5f80d8614ca2
("pxe_utils: harden the "append" parser against malformed input")?
Best regards,
Alexey
