On Sat, Oct 31, 2026 at 07:05:55AM -0700, Simon Glass wrote: > Hi Frieder, > > On 2026-10-29T16:23:07+11:00, Frieder Schrempf <[email protected]> wrote: > > bootstd: rauc: Fix overflow of the BOOT_x_LEFT name buffer > > > > The name of the BOOT_x_LEFT variable of a slot is written into a stack > > buffer of BOOT_LEFT_LEN bytes with sprintf(). BOOT_LEFT_LEN leaves room > > for a slot name of 32 characters, but not for the terminating NUL, and > > longer names are not limited at all. > > > > When booting, the slot names come from BOOT_ORDER in the environment, > > which is only checked against the configured slots when the bootflow is > > read. Setting BOOT_ORDER to a long name between 'bootflow scan' and > > 'bootflow boot' therefore overflows the buffer in find_active_slot(). > > > > Make room for the NUL, and write the name with snprintf() in a helper > > that fails with -E2BIG if it does not fit. > > > > Fixes: 7e5c2c782fb9 ("bootstd: Add implementation for bootmeth rauc") > > Assisted-by: LLM > > Signed-off-by: Frieder Schrempf <[email protected]> > > > > boot/bootmeth_rauc.c | 34 +++++++++++++++++++++++++++------- > > 1 file changed, 27 insertions(+), 7 deletions(-) > > > diff --git a/boot/bootmeth_rauc.c b/boot/bootmeth_rauc.c > > @@ -167,7 +176,10 @@ static int distro_rauc_read_bootflow(struct udevice > > *dev, struct bootflow *bflow > > - sprintf(boot_left, "BOOT_%s_LEFT", default_boot_order_list[i]); > > + if (boot_left_name(boot_left, default_boot_order_list[i])) { > > + str_free_list(default_boot_order_list); > > + return log_msg_ret("env", -E2BIG); > > + } > > This is a build-time configuration error: a slot name longer than 32 > characters in CONFIG_BOOTMETH_RAUC_BOOT_ORDER now quietly produces no > bootflow, and the log_msg_ret() output only appears with > CONFIG_LOG_ERROR_RETURN enabled. Please can you add a log_err() here, > as you do for the missing partition names in patch 6, and mention the > 32-character limit in the BOOTMETH_RAUC_BOOT_ORDER help? Also, the > other callers pass on the helper's return value, so it would be worth > returning 'ret' rather than repeating -E2BIG here. > > Reviewed-by: Simon Glass <[email protected]>
I've asked you before to not give both substantive changes and a reviewed-by tag. -- Tom
signature.asc
Description: PGP signature
