Dear Maintainer,

   * What led up to the situation?

I wanted to use the remap function with macro \x (hex ip)

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

Start with --map-file /somefile
In '/somefile', I have a rule:
r       /fai/efi/grub.cfg       /fai/efi/grub.cfg.d/\x

   * What was the outcome of this action?

Complaints from glibc about memory corruption, segfaults. Valgrind gave
54 errors. No working file.

   * What outcome did you expect instead?

Macro expansion and working file.


In tftpd/tftpd.c the function rewrite_macros is first called with
argument 'output' = NULL, asking for "how long will the string be".
A logic flaw makes the function return l=0 for macro 'x'. 0 bytes (+1
for string-ending NULL) is allocated, and then the actual macro
expansion is performed and stored there (8 bytes for ipv4, 32 for ipv6),
overwriting other memory.

Patch moves the 'if (output)' to only include the string copying, not
length calculation.

Same flaw exists in upstreams version 5.2 and Ubuntu version
5.2+20150808-1ubuntu3.

Hello hpa,

did you happen to see this issue? It was forwarded on to
https://bugzilla.syslinux.org/show_bug.cgi?id=76

I can't reproduce it with 7.2 (on arm64), maybe it was solved,
possibly by 04d7b0db0672ef5c7c36886e00f136672881a9ef?

Thanks,
Chris
[..]

Hi,

This was fixed quite a while ago. I can't remember if it was intentional or an accidental side effect of another change.

Closing this per info from upstream.