On 31.10.26 15:05, Simon Glass wrote: > Hi Frieder, > > On 2026-10-29T16:23:07+11:00, Frieder Schrempf <[email protected]> wrote: >> bootstd: rauc: Fix overflow of the BOOT_x_LEFT name buffer >> >> The name of the BOOT_x_LEFT variable of a slot is written into a stack >> buffer of BOOT_LEFT_LEN bytes with sprintf(). BOOT_LEFT_LEN leaves room >> for a slot name of 32 characters, but not for the terminating NUL, and >> longer names are not limited at all. >> >> When booting, the slot names come from BOOT_ORDER in the environment, >> which is only checked against the configured slots when the bootflow is >> read. Setting BOOT_ORDER to a long name between 'bootflow scan' and >> 'bootflow boot' therefore overflows the buffer in find_active_slot(). >> >> Make room for the NUL, and write the name with snprintf() in a helper >> that fails with -E2BIG if it does not fit. >> >> Fixes: 7e5c2c782fb9 ("bootstd: Add implementation for bootmeth rauc") >> Assisted-by: LLM >> Signed-off-by: Frieder Schrempf <[email protected]> >> >> boot/bootmeth_rauc.c | 34 +++++++++++++++++++++++++++------- >> 1 file changed, 27 insertions(+), 7 deletions(-) > >> diff --git a/boot/bootmeth_rauc.c b/boot/bootmeth_rauc.c >> @@ -167,7 +176,10 @@ static int distro_rauc_read_bootflow(struct udevice >> *dev, struct bootflow *bflow >> - sprintf(boot_left, "BOOT_%s_LEFT", default_boot_order_list[i]); >> + if (boot_left_name(boot_left, default_boot_order_list[i])) { >> + str_free_list(default_boot_order_list); >> + return log_msg_ret("env", -E2BIG); >> + } > > This is a build-time configuration error: a slot name longer than 32 > characters in CONFIG_BOOTMETH_RAUC_BOOT_ORDER now quietly produces no > bootflow, and the log_msg_ret() output only appears with > CONFIG_LOG_ERROR_RETURN enabled. Please can you add a log_err() here, > as you do for the missing partition names in patch 6, and mention the > 32-character limit in the BOOTMETH_RAUC_BOOT_ORDER help? Also, the > other callers pass on the helper's return value, so it would be worth > returning 'ret' rather than repeating -E2BIG here. Ok, I will fix this accordingly.
Thanks!
