From 4ca7c596691b3736c54ea384c2e0ffe789bed373 Mon Sep 17 00:00:00 2001 From: Hritik Naik Date: Thu, 3 Sep 2026 00:01:00 +0530 Subject: [PATCH] fs/procfs: fix buffer overflow in mount_sprintf vsnprintf() returns the total formatted string length even when truncated to info->line. Passing this untruncated length to procfs_memcpy causes a read beyond the 64-byte line staging buffer. Fixes #20011 Signed-off-by: Hritik Naik --- fs/mount/fs_procfs_mount.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/mount/fs_procfs_mount.c b/fs/mount/fs_procfs_mount.c index 792688f935bd1..6b076b0ca74f5 100644 --- a/fs/mount/fs_procfs_mount.c +++ b/fs/mount/fs_procfs_mount.c @@ -182,6 +182,11 @@ static void mount_sprintf(FAR struct mount_info_s *info, linesize = vsnprintf(info->line, info->linelen, fmt, ap); va_end(ap); + if (linesize >= info->linelen) + { + linesize = info->linelen - 1; + } + /* Copy the line buffer to the user buffer */ copysize = procfs_memcpy(info->line, linesize,