[PATCH 4/4] fs: tftp: use bounded format for TFTP error message debug print

[Ahmad Fatoum]

On 4/2/26 9:21 AM, Sascha Hauer wrote:
> The pr_debug for TFTP_ERROR uses %s to print the server's error
> message, but the message may not be null-terminated. This causes
> pr_debug to read past the packet data into uninitialized buffer
> memory.
> 
> Use %.*s with the remaining packet length to bound the read. This
> is only relevant in debug builds but is still worth fixing for
> correctness.
> 
> Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply at anthropic.com>

Reviewed-by: Ahmad Fatoum <a.fatoum at pengutronix.de>

> ---
>  fs/tftp.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/tftp.c b/fs/tftp.c
> index 6dd4829184..8f01754fc0 100644
> --- a/fs/tftp.c
> +++ b/fs/tftp.c
> @@ -631,7 +631,9 @@ static void tftp_recv(struct file_priv *priv,
>  		break;
>  
>  	case TFTP_ERROR:
> -		pr_debug("error: '%s' (%d)\n", pkt + 2, ntohs(*(uint16_t *)pkt));
> +		pr_debug("error: '%.*s' (%d)\n",
> +			 len > 2 ? len - 2 : 0, pkt + 2,
> +			 ntohs(*(uint16_t *)pkt));
>  		switch (ntohs(*(uint16_t *)pkt)) {
>  		case 1:
>  			priv->err = -ENOENT;
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |