From 37fad8b07e870e63f41331394f89fb3ae99106f1 Mon Sep 17 00:00:00 2001 From: OrbisAI Security Date: Fri, 15 May 2026 06:55:24 +0530 Subject: [PATCH] ixp4xx-microcode: use snprintf in IxNpeMicrocode.h Replace sprintf() calls with snprintf() to bound writes into the fixed-size filename[] and slnk[] stack buffers. While the current inputs are hash-pinned firmware images, snprintf provides defense in depth against buffer overflows if the format string output ever exceeds buffer capacity. Signed-off-by: OrbisAI Security Link: https://github.com/openwrt/openwrt/pull/23172 Signed-off-by: Jonas Jelonek --- package/firmware/ixp4xx-microcode/src/IxNpeMicrocode.h | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/package/firmware/ixp4xx-microcode/src/IxNpeMicrocode.h b/package/firmware/ixp4xx-microcode/src/IxNpeMicrocode.h index 4a843db104f..16377e1e6d1 100644 --- a/package/firmware/ixp4xx-microcode/src/IxNpeMicrocode.h +++ b/package/firmware/ixp4xx-microcode/src/IxNpeMicrocode.h @@ -116,12 +116,14 @@ int main(int argc, char *argv[]) *(unsigned*)field = to_be32(image->id); char filename[40], slnk[10]; - sprintf(filename, "NPE-%c.%08x", (field[0] & 0xf) + 'A', - image->id); + snprintf(filename, sizeof(filename), "NPE-%c.%08x", + (field[0] & 0xf) + 'A', image->id); if (image->id == 0x00090000) - sprintf(slnk, "NPE-%c-HSS", (field[0] & 0xf) + 'A'); + snprintf(slnk, sizeof(slnk), "NPE-%c-HSS", + (field[0] & 0xf) + 'A'); else - sprintf(slnk, "NPE-%c", (field[0] & 0xf) + 'A'); + snprintf(slnk, sizeof(slnk), "NPE-%c", + (field[0] & 0xf) + 'A'); printf("Writing image: %s.NPE_%c Func: %2x Rev: %02x.%02x " "Size: %5d to: '%s'\n", -- 2.47.3