Skip to content

nvram: 🛡️ Sentinel: [security improvement] Replace unsafe sprintf with snprintf#180

Merged
ManupaKDU merged 2 commits into
mainfrom
sentinel-nvram-sprintf-fix-11729375659188088495
Jun 21, 2026
Merged

nvram: 🛡️ Sentinel: [security improvement] Replace unsafe sprintf with snprintf#180
ManupaKDU merged 2 commits into
mainfrom
sentinel-nvram-sprintf-fix-11729375659188088495

Conversation

@ManupaKDU

Copy link
Copy Markdown

🚨 Severity: Medium
💡 Vulnerability: Unsafe C function sprintf is used in multiple places within nvram.c to format strings into fixed-size buffers. This could lead to buffer overflows if the formatted data exceeds the buffer size, allowing memory corruption or arbitrary code execution.
🎯 Impact: A malicious actor could craft specific nvram values or headers to trigger an overflow, potentially leading to privilege escalation or denial of service on the device running OpenWrt.
🔧 Fix: Replaced all instances of sprintf with snprintf, ensuring that formatting never writes past the allocated memory buffer.
✅ Verification: Ran sh test_ci.sh to verify tests pass. Visually inspected the code diff to ensure all sprintf calls were changed to snprintf.

Signed-off-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>


PR created automatically by Jules for task 11729375659188088495 started by @manupawickramasinghe

…h snprintf

Replaced all instances of `sprintf` with `snprintf` in nvram.c to prevent potential buffer overflows.

Signed-off-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

Co-authored-by: manupawickramasinghe <[email protected]>
@google-labs-jules

Copy link
Copy Markdown

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

…ntf with snprintf

Replaced all instances of `sprintf` with `snprintf` in nvram.c to prevent potential buffer overflows. Also fixed dynamic VLA allocation issue and added missing stdlib.h.

Signed-off-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

Co-authored-by: manupawickramasinghe <[email protected]>
@ManupaKDU ManupaKDU merged commit bed2c46 into main Jun 21, 2026
7 of 11 checks passed
@ManupaKDU ManupaKDU deleted the sentinel-nvram-sprintf-fix-11729375659188088495 branch June 21, 2026 09:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant