This is an automated email from the ASF dual-hosted git repository. acassis pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx-apps.git
commit 7a1c6aaa7c85610ebfc26b974f5a414345c6227a Author: wangjianyu3 <[email protected]> AuthorDate: Thu Aug 27 10:49:04 2026 +0800 system/nxinit: fix stack-buffer-overflow in init_parse_config_buffer init_parse_config_buffer() computed the per-refill copy length as MIN(len - off, sizeof(tmp)) without subtracting the 'n' leftover bytes already held at the front of 'tmp' from a previous refill, so memcpy(&tmp[n], ..., r) could write past the end of tmp[]. The file-based twin, init_parse_config_file(), already gets this right (read(fd, &buf[n], sizeof(buf) - n)). Reproduced locally with an AddressSanitizer host harness feeding the real 95-byte builtin "preset" rc content through init_parse_config_buffer() at CONFIG_SYSTEM_NXINIT_RC_LINE_MAX=32/48: ASan reports a stack-buffer-overflow on the 'tmp' array. Fixed to MIN(len - off, sizeof(tmp) - n) and reverified clean at RC_LINE_MAX=32/48/64/128. The default config never hits this (the builtin preset is 95 bytes and the default RC_LINE_MAX is 128), but SYSTEM_NXINIT_RC_LINE_MAX had no lower bound, so lowering it towards 32/48 for a smaller build would silently corrupt the stack while parsing the preset during boot. Add a "range 64 4096" bound so the value can no longer be set below the builtin preset's needs. Assisted-by: opencode:mimo-v2.5-pro Signed-off-by: wangjianyu3 <[email protected]> --- system/nxinit/Kconfig | 1 + system/nxinit/parser.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/system/nxinit/Kconfig b/system/nxinit/Kconfig index 3cd256bf7..29aa691c8 100644 --- a/system/nxinit/Kconfig +++ b/system/nxinit/Kconfig @@ -40,6 +40,7 @@ config SYSTEM_NXINIT_RC_FILE_PATH config SYSTEM_NXINIT_RC_LINE_MAX int "Max line length of RC file" default 128 + range 64 4096 ---help--- Maximum line length of RC file. More details: https://android.googlesource.com/platform/system/core/+/master/init/README.md diff --git a/system/nxinit/parser.c b/system/nxinit/parser.c index 664876b5a..c05f28917 100644 --- a/system/nxinit/parser.c +++ b/system/nxinit/parser.c @@ -109,7 +109,7 @@ static int init_parse_config_buffer(FAR const struct parser_s *parser, for (; ; ) { - r = MIN(len - off, sizeof(tmp)); + r = MIN(len - off, sizeof(tmp) - n); memcpy(&tmp[n], &buf[off], r); if (r == 0) {
