Mirrors_Framework/nuttx
1
0
Fork 0
mirror of https://github.com/apache/nuttx.git synced 2026-10-06 11:03:16 +08:00
Code Issues Packages Projects Releases Wiki Activity

fs/procfs: fix buffer overflow in mount_sprintf

Browse Source 
vsnprintf() returns the total formatted string length even when truncated to info->line. Passing this untruncated length to procfs_memcpy causes a read beyond the 64-byte line staging buffer.

Fixes #20011

Signed-off-by: Hritik Naik <hritiknaik16@gmail.com>
This commit is contained in:
Hritik Naik
2026-09-06 12:16:02 -03:00
committed by Alan C. Assis
parent e6d8fe32ea
commit 2a6a86cb68
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fs/mount/fs_procfs_mount.c
+5
View File
@@ -182,6 +182,11 @@ static void mount_sprintf(FAR struct mount_info_s *info,
linesize = vsnprintf(info->line, info->linelen, fmt, ap);
va_end(ap);
if (linesize >= info->linelen)
{
linesize = info->linelen - 1;
}
/* Copy the line buffer to the user buffer */
copysize = procfs_memcpy(info->line, linesize,