Code: static int nfs_readlink_reply(unsigned char *pkt, unsigned len)
 {
 	uint32_t *data;
 	char *path;
	int rlen;
 	int ret;
 
 	ret = rpc_check_reply(pkt, 1);
	if (ret)
		return ret;

	data = (uint32_t *)(pkt + sizeof(struct rpc_reply));

	data++;
 
 	rlen = ntohl(net_read_uint32(data)); /* new path length */
 
 	data++;
 	path = (char *)data;
	} else {
		memcpy(nfs_path, path, rlen);
		nfs_path[rlen] = 0;
	}

Vulnerability Type: Overflow
CWE ID: CWE-119
Summary: Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length field is directly used for a memcpy.
Commit Message: 