port-i386/44008: long boot.cfg command overruns buffer

[itohy%netbsd.org@localhost]

>Number:         44008
>Category:       port-i386
>Synopsis:       long boot.cfg command overruns buffer
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-i386-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Oct 29 04:25:00 +0000 2010
>Originator:     ITOH Yasufumi
>Release:        NetBSD 5.99.39
>Organization:
>Environment:
System: NetBSD zun 5.99.39 NetBSD 5.99.39 (ZUN3PAE_DOM0) #2: Fri Oct 15 
20:32:08 JST 2010 itohy@zun:/usr/src/current/sys/arch/i386/compile/ZUN3PAE_DOM0 
i386
Architecture: i386
Machine: i386
amd64 is also affected.

>Description:
        The length of a boot.cfg command is limited to ~80 bytes,
        which is rather too short.
        If the length is longer than ~80bytes, it corrupts stack.

>How-To-Repeat:
        Try following line in /boot.cfg and boot XEN.

menu=Boot Xen with 3.5GB for dom0:load /netbsd-XEN3PAE_DOM0 console=pc 
pciback.hide=(00:1a.0)(00:1a.1)(00:1a.2)(00:1a.7); multiboot /xen.gz 
dom0_mem=3584M

        dmesg:

pci0: i/o space, memory space enabled
pciback_pci_init: hide claim device 0:1a:0
pciback_pci_init: hide claim device 0:1a:1
pciback_pci_init: hide claim device 0:1a:2
pciback_pci_init: syntax error at 00:1a.
...

        Note the load command exeeds 80byte long and pciback.hide string
        is cut in the midle.

>Fix:
        At least sys/arch/i386/stand/lib/bootmenu.c::doboottypemenu()
        copies a command into 80byte buffer (without boundary checking)
        and needs fixed.

        Here's untested patch.  The maximum size of boot.ini is 32KB.

Index: bootmenu.c
===================================================================
RCS file: /cvsroot/src/sys/arch/i386/stand/lib/bootmenu.c,v
retrieving revision 1.8
diff -u -p -r1.8 bootmenu.c
--- bootmenu.c  14 Sep 2009 10:42:42 -0000      1.8
+++ bootmenu.c  24 Oct 2010 04:19:31 -0000
@@ -290,7 +290,7 @@ void
 doboottypemenu(void)
 {
        int choice;
-       char input[80], *ic, *oc;
+       char input[32768], *ic, *oc;
 
        printf("\n");
        /* Display menu */