openwrt-mirror/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2026-07-12 22:44:49 +04:00
Code Issues Packages Projects Releases Wiki Activity

ixp4xx-microcode: use snprintf in IxNpeMicrocode.h

Browse Source 
Replace sprintf() calls with snprintf() to bound writes into the
fixed-size filename[] and slnk[] stack buffers. While the current
inputs are hash-pinned firmware images, snprintf provides defense
in depth against buffer overflows if the format string output ever
exceeds buffer capacity.

Signed-off-by: OrbisAI Security <mediratta01.pally@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23172
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This commit is contained in:
OrbisAI Security
2026-05-15 06:55:24 +05:30
committed by Jonas Jelonek
parent 4b2e7031b2
commit 37fad8b07e
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package/firmware/ixp4xx-microcode/src/IxNpeMicrocode.h
+6 -4
View File
@@ -116,12 +116,14 @@ int main(int argc, char *argv[])
*(unsigned*)field = to_be32(image->id);
char filename[40], slnk[10];
sprintf(filename, "NPE-%c.%08x", (field[0] & 0xf) + 'A',
image->id);
snprintf(filename, sizeof(filename), "NPE-%c.%08x",
(field[0] & 0xf) + 'A', image->id);
if (image->id == 0x00090000)
sprintf(slnk, "NPE-%c-HSS", (field[0] & 0xf) + 'A');
snprintf(slnk, sizeof(slnk), "NPE-%c-HSS",
(field[0] & 0xf) + 'A');
else
sprintf(slnk, "NPE-%c", (field[0] & 0xf) + 'A');
snprintf(slnk, sizeof(slnk), "NPE-%c",
(field[0] & 0xf) + 'A');
printf("Writing image: %s.NPE_%c Func: %2x Rev: %02x.%02x "
"Size: %5d to: '%s'\n",