[I] [BUG] [nuttx]</span></a></span> </h1> <p class="darkgray font13"> <span class="sender pipe"><a href="/search?l=commits@nuttx.apache.org&q=from:%22via+GitHub%22" rel="nofollow"><span itemprop="author" itemscope itemtype="http://schema.org/Person"><span itemprop="name">via GitHub</span></span></a></span> <span class="date"><a href="/search?l=commits@nuttx.apache.org&q=date:20260829" rel="nofollow">Sat, 29 Aug 2026 22:43:41 -0700</a></span> </p> </div> <div itemprop="articleBody" class="msgBody"> <!--X-Body-of-Message--> <pre> Arslan8 opened a new issue, #20011: URL: <a rel="nofollow" href="https://github.com/apache/nuttx/issues/20011">https://github.com/apache/nuttx/issues/20011</a></pre><pre> ### Description / Steps to reproduce the issue `mount_sprintf()` can read beyond its 64-byte staging buffer when formatting a sufficiently long mountpoint for `/proc/fs/mount`. The function first formats a mount entry into `info->line` using `vsnprintf()`: ```c linesize = vsnprintf(info->line, info->linelen, fmt, ap); ``` `info->line` is 64 bytes (`MOUNT_LINELEN`). If the formatted output is longer than this buffer, `vsnprintf()` safely truncates the stored string, but its return value is the full length that would have been written if enough space were available. `mount_sprintf()` then passes this untruncated length to `procfs_memcpy()`: ```c copysize = procfs_memcpy(info->line, linesize, info->buffer, info->remaining, &info->offset); ``` As a result, `procfs_memcpy()` can copy more than 64 bytes from `info->line`, causing a read beyond the end of the staging buffer. This is reachable through the normal `/proc/fs/mount` interface because mountpoints are inserted directly into the formatted line: ```c mount_sprintf(info, " %s type %s\n", mountpoint, fstype); ``` For example, with filesystem type `tmpfs`, the formatted length is approximately: ```text strlen(mountpoint) + 14 ``` so a mountpoint of 51 or more characters causes the intended output to exceed the 64-byte staging buffer. ### Steps to reproduce 1. Build NuttX with ProcFS and filesystem mounting support enabled. 2. Create a mountpoint with a sufficiently long path, for example a path longer than 50 characters when using `tmpfs`. 3. Mount a filesystem such as `tmpfs` at that path. 4. Read `/proc/fs/mount` using a read buffer large enough to request the complete entry. 5. `mount_sprintf()` truncates the formatted entry to its 64-byte `info->line` buffer, but uses the larger return value from `vsnprintf()` as the source length passed to `procfs_memcpy()`. 6. `procfs_memcpy()` consequently reads beyond the end of `info->line`. The expected behavior is that the copy length is limited to the number of bytes actually stored in `info->line`, e.g. at most `info->linelen - 1`, rather than using the unbounded length returned by `vsnprintf()`. ### On which OS does this issue occur? [OS: Linux] ### What is the version of your OS? Ubuntu 24.04 ### NuttX Version master ### Issue Architecture [Arch: all] ### Issue Area [Area: File System] ### Host information _No response_ ### Verification - [x] I have verified before submitting the report. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: commits-unsubscr...@nuttx.apache.org.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org </pre> </div> <div class="msgButtons margintopdouble"> <ul class="overflow"> <li class="msgButtonItems"><a class="button buttonleft " accesskey="p" href="msg170718.html">Previous message</a></li> <li class="msgButtonItems textaligncenter"><a class="button" accesskey="c" href="thrd2.html#170719">View by thread</a></li> <li class="msgButtonItems textaligncenter"><a class="button" accesskey="i" href="mail3.html#170719">View by date</a></li> <li class="msgButtonItems textalignright"><a class="button buttonright " accesskey="n" href="msg171022.html">Next message</a></li> </ul> </div> <a name="tslice"></a> <div class="tSliceList margintopdouble"> <ul class="icons monospace"> <li class="icons-email tSliceCur"><span class="subject">[I] [BUG] <title> [nuttx]</span> <span class="sender italic">via GitHub</span></li> <li><ul> <li class="icons-email"><span class="subject"><a href="msg171022.html">Re: [I] [BUG] buffer overflow in mount_sprintf [nuttx]</a></span> <span class="sender italic">via GitHub</span></li> <li class="icons-email"><span class="subject"><a href="msg171167.html">Re: [I] [BUG] buffer overflow in mount_sprintf [nuttx]</a></span> <span class="sender italic">via GitHub</span></li> <li class="icons-email"><span class="subject"><a href="msg171171.html">Re: [I] [BUG] buffer overflow in mount_sprintf [nuttx]</a></span> <span class="sender italic">via GitHub</span></li> <li class="icons-email"><span class="subject"><a href="msg171179.html">Re: [I] [BUG] buffer overflow in mount_sprintf [nuttx]</a></span> <span class="sender italic">via GitHub</span></li> </ul> </ul> </div> <div class="overflow msgActions margintopdouble"> <div class="msgReply" > <h2> Reply via email to </h2> <form method="POST" action="/mailto.php"> <input type="hidden" name="subject" value="[I] [BUG] <title> [nuttx]"> <input type="hidden" name="msgid" value="I_kwDODZiUac8AAAABO1e6Wg@gitbox.apache.org"> <input type="hidden" name="relpath" value="commits@nuttx.apache.org/msg170719.html"> <input type="submit" value=" via GitHub "> </form> </div> </div> </div> <div class="aside" role="complementary"> <div class="logo"> <a href="/"><img src="/logo.png" width=247 height=88 alt="The Mail Archive"></a> </div> <form class="overflow" action="/search" method="get"> <input type="hidden" name="l" value="commits@nuttx.apache.org"> <label class="hidden" for="q">Search the site</label> <input class="submittext" type="text" id="q" name="q" placeholder="Search commits"> <input class="submitbutton" name="submit" type="image" src="/submit.png" alt="Submit"> </form> <div class="nav margintop" id="nav" role="navigation"> <ul class="icons font16"> <li class="icons-home"><a href="/">The Mail Archive home</a></li> <li class="icons-list"><a href="/commits@nuttx.apache.org/">commits - all messages</a></li> <li class="icons-about"><a href="/commits@nuttx.apache.org/info.html">commits - about the list</a></li> <li class="icons-expand"><a href="/search?l=commits@nuttx.apache.org&q=subject:%22%5C%5BI%5C%5D+%5C%5BBUG%5C%5D+%3Ctitle%3E+%5C%5Bnuttx%5C%5D%22&o=newest&f=1" title="e" id="e">Expand</a></li> <li class="icons-prev"><a href="msg170718.html" title="p">Previous message</a></li> <li class="icons-next"><a href="msg171022.html" title="n">Next message</a></li> </ul> </div> <div class="listlogo margintopdouble"> </div> <div class="margintopdouble"> </div> </div> </div> <div class="footer" role="contentinfo"> <ul> <li><a href="/">The Mail Archive home</a></li> <li><a href="/faq.html#newlist">Add your mailing list</a></li> <li><a href="/faq.html">FAQ</a></li> <li><a href="/faq.html#support">Support</a></li> <li><a href="/faq.html#privacy">Privacy</a></li> <li class="darkgray">I_kwDODZiUac8AAAABO1e6Wg@gitbox.apache.org</li> </ul> </div> </body> </html>