diff options
| author | Mariusz Zaborski <oshogbo@FreeBSD.org> | 2026-04-28 14:35:10 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-04-28 20:33:58 +0000 |
| commit | a5cb4863d65a64cc16a81f49b35b944d9b9b14f2 (patch) | |
| tree | 5a8979a2366df14caad50faef2341ed9d3314348 /lib/libedit | |
| parent | adaed0700d2d1a84c0c1d6826fb9a1a23d83b603 (diff) | |
libnv: switch fd_wait() from select(2) to poll(2)
The previous implementation used FD_SET() on a stack-allocated fd_set,
which is an out-of-bounds write whenever the socket fd is >= FD_SETSIZE
(1024).
Approved by: so
Security: FreeBSD-SA-26:16.libnv
Security: CVE-2026-39457
Reported by: Joshua Rogers of AISLE Research Team (https://aisle.com/)
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D56689
Diffstat (limited to 'lib/libedit')
0 files changed, 0 insertions, 0 deletions