diff options
| author | Mariusz Zaborski <oshogbo@FreeBSD.org> | 2026-04-28 14:36:09 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-04-29 14:40:57 +0000 |
| commit | 414e25d7d5128e5d0275f18a6633a11d36fafc8c (patch) | |
| tree | 86ee4d6c6f1ef31e32eeecf2cdced5fb22225208 /sys | |
| parent | 025789eaa648bdb3f3400f3d6412947cc151ebd8 (diff) | |
libnv: fix heap overflow in nvlist_recv()
nvlist_check_header() validated nvlh_size for overflow before
performing conversion. An mallicous user can set
NV_FLAG_BIG_ENDIAN in the header and craft nvlh_size so that
the orginall value passes the check, but after the conversion the
sizeof(nvlist_header) + size can overflow.
This can lead to a heap buffer overflow.
Approved by: so
Security: FreeBSD-SA-26:17.libnv
Security: CVE-2026-35547
Fixes: 36fa90dbde0060aacb5677d0b113ee168e839071
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D56342
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/contrib/libnv/nvlist.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/sys/contrib/libnv/nvlist.c b/sys/contrib/libnv/nvlist.c index 73226ee51a78..11d9c9b49c94 100644 --- a/sys/contrib/libnv/nvlist.c +++ b/sys/contrib/libnv/nvlist.c @@ -1027,10 +1027,6 @@ static bool nvlist_check_header(struct nvlist_header *nvlhdrp) { - if (nvlhdrp->nvlh_size > SIZE_MAX - sizeof(*nvlhdrp)) { - ERRNO_SET(EINVAL); - return (false); - } if (nvlhdrp->nvlh_magic != NVLIST_HEADER_MAGIC) { ERRNO_SET(EINVAL); return (false); @@ -1050,6 +1046,11 @@ nvlist_check_header(struct nvlist_header *nvlhdrp) nvlhdrp->nvlh_descriptors = be64toh(nvlhdrp->nvlh_descriptors); } #endif + if (nvlhdrp->nvlh_size > SIZE_MAX - sizeof(*nvlhdrp)) { + ERRNO_SET(EINVAL); + return (false); + } + return (true); } |