This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch releases/13.1
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/releases/13.1 by this push:
new 1e3248bec2b fs/procfs: fix buffer overflow in mount_sprintf
1e3248bec2b is described below
commit 1e3248bec2b15b492fef4a78a6187d4647ea12d4
Author: Hritik Naik <[email protected]>
AuthorDate: Thu Sep 3 00:01:00 2026 +0530
fs/procfs: fix buffer overflow in mount_sprintf
vsnprintf() returns the total formatted string length even when truncated
to info->line. Passing this untruncated length to procfs_memcpy causes a read
beyond the 64-byte line staging buffer.
Fixes #20011
Signed-off-by: Hritik Naik <[email protected]>
---
fs/mount/fs_procfs_mount.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/mount/fs_procfs_mount.c b/fs/mount/fs_procfs_mount.c
index 792688f935b..6b076b0ca74 100644
--- a/fs/mount/fs_procfs_mount.c
+++ b/fs/mount/fs_procfs_mount.c
@@ -182,6 +182,11 @@ static void mount_sprintf(FAR struct mount_info_s *info,
linesize = vsnprintf(info->line, info->linelen, fmt, ap);
va_end(ap);
+ if (linesize >= info->linelen)
+ {
+ linesize = info->linelen - 1;
+ }
+
/* Copy the line buffer to the user buffer */
copysize = procfs_memcpy(info->line, linesize,
