Re: [PATCH] mtd: parsers: redboot: reject unterminated FIS names

From: Miquel Raynal

Date: Thu Jul 02 2026 - 09:22:59 EST


Hi Pengpeng,

On 01/07/2026 at 13:39:09 +08, Pengpeng Hou <pengpeng@xxxxxxxxxxx> wrote:

> RedBoot FIS partition names are stored in a fixed 16-byte field that is
> expected to be NUL-terminated. parse_redboot_partitions() used strlen()
> to size the names area and later copied the same field with strcpy(), so
> a malformed table entry without a terminator could make both operations
> read beyond the descriptor.
>
> Validate each accepted FIS name with strnlen() before adding it to the
> partition list.
>
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>

Please add Fixes and Cc stable tags whenever you send a fix. The fixes
look correct and are correctly documented, but all of them miss
the tags.

Thanks,
Miquèl