[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: port-i386/44008: long boot.cfg command overruns buffer
The following reply was made to PR port-i386/44008; it has been noted by GNATS.
From: David Holland <dholland-bugs%netbsd.org@localhost>
Subject: Re: port-i386/44008: long boot.cfg command overruns buffer
Date: Sun, 2 Oct 2016 19:14:24 +0000
On Fri, Oct 29, 2010 at 04:25:01AM +0000, itohy%netbsd.org@localhost wrote:
> The length of a boot.cfg command is limited to ~80 bytes,
> which is rather too short.
> If the length is longer than ~80bytes, it corrupts stack.
> Try following line in /boot.cfg and boot XEN.
> menu=Boot Xen with 3.5GB for dom0:load /netbsd-XEN3PAE_DOM0 console=pc pciback.hide=(00:1a.0)(00:1a.1)(00:1a.2)(00:1a.7); multiboot /xen.gz dom0_mem=3584M
> At least sys/arch/i386/stand/lib/bootmenu.c::doboottypemenu()
> copies a command into 80byte buffer (without boundary checking)
> and needs fixed.
> Here's untested patch. The maximum size of boot.ini is 32KB.
> Index: bootmenu.c
> RCS file: /cvsroot/src/sys/arch/i386/stand/lib/bootmenu.c,v
> retrieving revision 1.8
> diff -u -p -r1.8 bootmenu.c
> --- bootmenu.c 14 Sep 2009 10:42:42 -0000 1.8
> +++ bootmenu.c 24 Oct 2010 04:19:31 -0000
> @@ -290,7 +290,7 @@ void
> int choice;
> - char input, *ic, *oc;
> + char input, *ic, *oc;
> /* Display menu */
I don't see any way boot.cfg data can get into this buffer, which is
used only for console input. (which nowadays is bounded properly)
David A. Holland
Main Index |
Thread Index |