Stack buffer overflow in RT-Thread IPC

Hi,

I would like to report another potential vulnerability in the current version of RT-Thread. Please let me know if you plan to ask for a CVE ID in case the vulnerability is confirmed. I'm available if you need further clarifications.

Potential stack buffer overflow in RT-Thread IPC

Summary

I spotted a potential stack buffer overflow vulnerability at the following location in the RT-Thread IPC source code:
https://github.com/RT-Thread/rt-thread/blob/master/components/libc/posix/ipc/mqueue.c#L278

Details

Unbounded rt_sprintf() in the mq_unlink() function could lead to a stack buffer overflow at the marked line:

int mq_unlink(const char *name)
{
    if(*name == '/')
    {
        name++;
    }
    const char *mq_path = "/dev/mqueue/";
    char mq_name[RT_NAME_MAX + 12] = {0};
    rt_sprintf(mq_name, "%s%s", mq_path, name); /* VULN: stack buffer overflow */
    return unlink(mq_name);
}

Please note that the mq_open() function at https://github.com/RT-Thread/rt-thread/blob/master/components/libc/posix/ipc/mqueue.c#L65-L70 implements bound checking:

    int len = rt_strlen(name);
    if (len > RT_NAME_MAX)
    {
        rt_set_errno(ENAMETOOLONG);
        return (mqd_t)(-1);
    }

Impact

If the unchecked input above is confirmed to be attacker-controlled and crossing a security boundary, the impact of the reported buffer overflow vulnerability could range from denial of service to arbitrary code execution.

Start in components/libc/posix/ipc/mqueue.c at mq_unlink(), then compare its name handling with the bound check in mq_open() around lines 65-70. Determine whether the reported input can exceed the stack buffer and whether the issue is confirmed; done means the overflow concern is resolved or documented with verification of the affected IPC behavior.