Arslan8 opened a new issue, #20011:
URL: https://github.com/apache/nuttx/issues/20011
### Description / Steps to reproduce the issue
`mount_sprintf()` can read beyond its 64-byte staging buffer when formatting
a sufficiently long mountpoint for `/proc/fs/mount`.
The function first formats a mount entry into `info->line` using
`vsnprintf()`:
```c
linesize = vsnprintf(info->line, info->linelen, fmt, ap);
```
`info->line` is 64 bytes (`MOUNT_LINELEN`). If the formatted output is
longer than this buffer, `vsnprintf()` safely truncates the stored string, but
its return value is the full length that would have been written if enough
space were available.
`mount_sprintf()` then passes this untruncated length to `procfs_memcpy()`:
```c
copysize = procfs_memcpy(info->line, linesize,
info->buffer, info->remaining,
&info->offset);
```
As a result, `procfs_memcpy()` can copy more than 64 bytes from
`info->line`, causing a read beyond the end of the staging buffer.
This is reachable through the normal `/proc/fs/mount` interface because
mountpoints are inserted directly into the formatted line:
```c
mount_sprintf(info, " %s type %s\n", mountpoint, fstype);
```
For example, with filesystem type `tmpfs`, the formatted length is
approximately:
```text
strlen(mountpoint) + 14
```
so a mountpoint of 51 or more characters causes the intended output to
exceed the 64-byte staging buffer.
### Steps to reproduce
1. Build NuttX with ProcFS and filesystem mounting support enabled.
2. Create a mountpoint with a sufficiently long path, for example a path
longer than 50 characters when using `tmpfs`.
3. Mount a filesystem such as `tmpfs` at that path.
4. Read `/proc/fs/mount` using a read buffer large enough to request the
complete entry.
5. `mount_sprintf()` truncates the formatted entry to its 64-byte
`info->line` buffer, but uses the larger return value from `vsnprintf()` as the
source length passed to `procfs_memcpy()`.
6. `procfs_memcpy()` consequently reads beyond the end of `info->line`.
The expected behavior is that the copy length is limited to the number of
bytes actually stored in `info->line`, e.g. at most `info->linelen - 1`, rather
than using the unbounded length returned by `vsnprintf()`.
### On which OS does this issue occur?
[OS: Linux]
### What is the version of your OS?
Ubuntu 24.04
### NuttX Version
master
### Issue Architecture
[Arch: all]
### Issue Area
[Area: File System]
### Host information
_No response_
### Verification
- [x] I have verified before submitting the report.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscr...@nuttx.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org