提交: 085cbdafca9c3d7bc2f27523a343f61db82f2ccb - uboot (git)

Commit MetaInfo

• 修订版: 085cbdafca9c3d7bc2f27523a343f61db82f2ccb (tree)
• 时间: 2022-07-19 00:21:49
• 作者: Heinrich Schuchardt <heinrich.schuchardt@cano...>
• Commiter: Heinrich Schuchardt

Log Message

pxe: simplify label_boot()

Coverity CID 131256 indicates a possible buffer overflow in label_boot().
This would only occur if the size of the downloaded file would exceed 4
GiB. But anyway we can simplify the code by using snprintf() and checking
the return value.

Addresses-Coverity-ID: 131256 ("Security best practices violations (STRING_OVERFLOW)")
Signed-off-by: Heinrich Schuchardt <[e-mail]>
Reviewed-by: Ramon Fried <[e-mail]>
Reviewed-by: Artem Lapkin <[e-mail]>

更改概述

• modified: boot/pxe_utils.c

差异

--- a/boot/pxe_utils.c
+++ b/boot/pxe_utils.c
@@ -532,11 +532,10 @@ static int label_boot(struct pxe_context *ctx, struct pxe_label *label)
 		}
 
 		initrd_addr_str = env_get("ramdisk_addr_r");
-		strcpy(initrd_filesize, simple_xtoa(size));
-
-		strncpy(initrd_str, initrd_addr_str, 18);
-		strcat(initrd_str, ":");
-		strncat(initrd_str, initrd_filesize, 9);
+		size = snprintf(initrd_str, sizeof(initrd_str), "%s:%lx",
+				initrd_addr_str, size);
+		if (size >= sizeof(initrd_str))
+			return 1;
 	}
 
 	if (get_relfile_envaddr(ctx, label->kernel, "kernel_addr_r",