From 9ce9ed72a917f776ab881dc49041534face96141 Mon Sep 17 00:00:00 2001 From: Eduard Shishkin Date: Wed, 15 Jul 2026 11:31:13 +0200 Subject: [PATCH] zipl/boot: Fix the bounds check in the command line processing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit By design, before replacement of '${FOO}' with its value, the procedure checks that the resulted command line doesn't exceed the maximum one. The old check used the never updated length of the original command line, which is incorrect. Instead, use its current length resulting from the replacement happened at the previous iteration. Reviewed-by: Stefan Haberland Signed-off-by: Eduard Shishkin Signed-off-by: Jan Höppner --- zipl/boot/stage3.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/zipl/boot/stage3.c b/zipl/boot/stage3.c index 25b14767..007cf91e 100644 --- a/zipl/boot/stage3.c +++ b/zipl/boot/stage3.c @@ -292,7 +292,8 @@ void process_parm_line(struct env_hash_entry **buckets, unsigned int cmdl_len, */ len = strlen(val); - if (cmdl_len + len - (end - start + 1) >= max_len) + if ((cmdl_end - (char *)COMMAND_LINE) + len - + (end - start + 1) >= max_len) /* VALUE doesn't fit */ break; /* @@ -309,6 +310,10 @@ void process_parm_line(struct env_hash_entry **buckets, unsigned int cmdl_len, start += len; } if (cmdl_len > cmdl_end - (char *)COMMAND_LINE) + /* + * the resulted command line is shorter than the + * original one. Erase the garbage at the end + */ memset(cmdl_end, 0, cmdl_len - (cmdl_end - (char *)COMMAND_LINE)); }