Re: port-i386/44008: long boot.cfg command overruns buffer

[David Holland <dholland-bugs%netbsd.org@localhost>]

The following reply was made to PR port-i386/44008; it has been noted by GNATS.

From: David Holland <dholland-bugs%netbsd.org@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: port-i386/44008: long boot.cfg command overruns buffer
Date: Sun, 2 Oct 2016 19:14:24 +0000

 On Fri, Oct 29, 2010 at 04:25:01AM +0000, itohy%netbsd.org@localhost wrote:
  > 	The length of a boot.cfg command is limited to ~80 bytes,
  > 	which is rather too short.
  > 	If the length is longer than ~80bytes, it corrupts stack.
  > 
  > >How-To-Repeat:
  > 	Try following line in /boot.cfg and boot XEN.
  > 
  > menu=Boot Xen with 3.5GB for dom0:load /netbsd-XEN3PAE_DOM0 console=pc pciback.hide=(00:1a.0)(00:1a.1)(00:1a.2)(00:1a.7); multiboot /xen.gz dom0_mem=3584M
 
 ok...
 
 but,
 
  > 	At least sys/arch/i386/stand/lib/bootmenu.c::doboottypemenu()
  > 	copies a command into 80byte buffer (without boundary checking)
  > 	and needs fixed.
  > 
  > 	Here's untested patch.  The maximum size of boot.ini is 32KB.
  > 
  > Index: bootmenu.c
  > ===================================================================
  > RCS file: /cvsroot/src/sys/arch/i386/stand/lib/bootmenu.c,v
  > retrieving revision 1.8
  > diff -u -p -r1.8 bootmenu.c
  > --- bootmenu.c	14 Sep 2009 10:42:42 -0000	1.8
  > +++ bootmenu.c	24 Oct 2010 04:19:31 -0000
  > @@ -290,7 +290,7 @@ void
  >  doboottypemenu(void)
  >  {
  >  	int choice;
  > -	char input[80], *ic, *oc;
  > +	char input[32768], *ic, *oc;
  >  
  >  	printf("\n");
  >  	/* Display menu */
 
 I don't see any way boot.cfg data can get into this buffer, which is
 used only for console input. (which nowadays is bounded properly)
 
 -- 
 David A. Holland
 dholland%netbsd.org@localhost