On Thu, 01 Oct 2026 09:29:57 +0530, Suraj Kakade wrote:
> pxe_menu_to_menu() numbers each extlinux/PXE label with sprintf() into
> char num[4]. That buffer holds at most three digits plus NUL, so the
> 1000th label writes one byte past num. On 32-bit, name sits immediately
> after num, so the overflow corrupts the name pointer and the menu prints
> a corrupted label. On 64-bit, alignment padding absorbs that extra byte,
> so the overflow is not visible in the printed name.
>
> [...]
Applied to u-boot-net branch for-next, thanks!
[1/1] boot: pxe_utils: Fix buffer overflow in pxe_label.num
commit: 2a64093c2f924bc072aff39ec6bfd77d32cc8646
Best regards,
--
Jerome Forissier <[email protected]>
