diff options
| author | Mariusz Zaborski <oshogbo@FreeBSD.org> | 2024-08-26 18:20:24 +0000 |
|---|---|---|
| committer | Ed Maste <emaste@FreeBSD.org> | 2024-09-04 20:28:56 +0000 |
| commit | 33b4e2361c82b269d42c0d787e8900d1bde5de71 (patch) | |
| tree | e9a789387cca9fe0c2ebbb3704030ca9e3ae1afe | |
| parent | fd4ee5b9eabf1843a0b67dca583696b91bd7fb13 (diff) | |
libnv: verify that string is null terminated
During unpacking, we ensure that we do not read beyond the
declared size. However, unpack uses a function that copies
null-terminated strings. Prior to this commit, if the last string
was not null-terminated, it could result in copying data into a
buffer smaller than the allocated size.
Security: FreeBSD-24:09.libnv
Security: CVE-2024-45288
Security: CAP-03
Reported by: Synacktiv
Sponsored by: The Alpha-Omega Project
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D46138
(cherry picked from commit 3aaaca1b51ad844ef9e9b3d945217ab3dd189bae)
(cherry picked from commit 03bef9971d73621e1703a0bad41b598bc2fce9c6)
Approved by: so
| -rw-r--r-- | sys/contrib/libnv/bsd_nvpair.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sys/contrib/libnv/bsd_nvpair.c b/sys/contrib/libnv/bsd_nvpair.c index 41d262a18c9b..cfe168c38026 100644 --- a/sys/contrib/libnv/bsd_nvpair.c +++ b/sys/contrib/libnv/bsd_nvpair.c @@ -986,6 +986,10 @@ nvpair_unpack_string_array(bool isbe __unused, nvpair_t *nvp, for (ii = 0; ii < nvp->nvp_nitems; ii++) { len = strnlen(tmp, size - 1) + 1; size -= len; + if (tmp[len - 1] != '\0') { + ERRNO_SET(EINVAL); + return (NULL); + } if (size < 0) { ERRNO_SET(EINVAL); return (NULL); |