From nobody Sun Feb 06 18:07:35 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 6FEB219AC6E2; Sun, 6 Feb 2022 18:07:39 +0000 (UTC) (envelope-from dim@FreeBSD.org) Received: from smtp.freebsd.org (smtp.freebsd.org [IPv6:2610:1c1:1:606c::24b:4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4JsHLM2cRKz3kWX; Sun, 6 Feb 2022 18:07:39 +0000 (UTC) (envelope-from dim@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1644170859; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=cBUkhY1d9bh/Nnf9swRbvnfi/0jKKoxh6vsQIzj3ZdU=; b=kgDM++n5LGCsOSwfNxPHfBgbhDRy3GS0Z4orpX47w07Md+h1TgF3FWY3yoaddY1PoyMhR9 ceuH5ln/mZJkm73vNkSdSMS+fbwls/dP69PSldZAGNxvqQQqZxeX98LASdNwQxV2SMG216 RUoT94UoEEc/xIk5j9VQMRBbEo5dWUlVFt5vkHNKFCVMKNICGsoNK40xeHianLKmBJyZDU xA34qOYSv2itHxh1/GgY8hLHh6edmuEudDoY4WQSPGA/74kAw4l9A2q4NnzG2gMJGaC4Fg MmeNvKW39tSaCEc225U/yVjVcKzBsANKn634GegTvODYVDvql9clXXu2NA7odg== Received: from tensor.andric.com (tensor.andric.com [87.251.56.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "tensor.andric.com", Issuer "R3" (verified OK)) (Authenticated sender: dim) by smtp.freebsd.org (Postfix) with ESMTPSA id 1D57A228DE; Sun, 6 Feb 2022 18:07:39 +0000 (UTC) (envelope-from dim@FreeBSD.org) Received: from smtpclient.apple (longrow.home.andric.com [192.168.0.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by tensor.andric.com (Postfix) with ESMTPSA id DCB832A1F9; Sun, 6 Feb 2022 19:07:35 +0100 (CET) Content-Type: multipart/signed; boundary="Apple-Mail=_3667A5D8-3CF2-47DF-86A9-AE2ACDD12B2D"; protocol="application/pgp-signature"; micalg=pgp-sha1 List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org Mime-Version: 1.0 (Mac OS X Mail 15.0 \(3693.60.0.1.1\)) Subject: Re: git: e17fede8ff46 - main - Fix too small sscanf output buffers in kbdmap From: Dimitry Andric In-Reply-To: <20220206154131.ym3wthb4jby4jz25@mutt-hbsd> Date: Sun, 6 Feb 2022 19:07:35 +0100 Cc: "src-committers@freebsd.org" , "dev-commits-src-all@freebsd.org" , "dev-commits-src-main@freebsd.org" Message-Id: References: <202202061526.216FQ0uH082668@gitrepo.freebsd.org> <20220206154131.ym3wthb4jby4jz25@mutt-hbsd> To: Shawn Webb X-Mailer: Apple Mail (2.3693.60.0.1.1) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1644170859; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=cBUkhY1d9bh/Nnf9swRbvnfi/0jKKoxh6vsQIzj3ZdU=; b=JCLVUfSQyPex8y9MbfvF1F53ke5gmZV36MkCsyM1lp5quolaniS7DbfDCm1yKUKvw1yKQ4 lo1eT9GXLtd83nShJ83tTiERcYa456pkW0kBr9IbeduuQqKR3asU5JkTF4oAfgwX8izLlV Acxn4lor2PatvXIgEEAsKqD+usTTKIgboXOK35RmHr3YzIunsMWaXksUaG2J9Nes6+PsXa O2awytxsBUrlM9FbpkItN69CtFkcp+jb4YD9ZGXWfZNgipg8j7FyENLI9+P1qgRmfkdg0r Rn68HipQSBqdYp2z8NXkRgR4ZaaxZXqLVdy+Utm3kMnIqfxllLqRPM6Nzjcdbw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1644170859; a=rsa-sha256; cv=none; b=Uo571aSwEbMoJftrwvvo7vkrSeGyFPILxe0horHtXQbfQDZ5Qmmd/yEZtBYloQNw8yI+2B 6ZTcZyLWaO3O0mbdQdVyS0OdgVyy1tw+mK6qaX+hOSCiNrHak6joukjZBC81tjpUJXr5Ir 1ZSXGr/fawhAs4k7FiyeHsgrhdt9VI4Dts8zcdWla8ZlWc052fEF/VaQ9mqT4SOdR3X1SZ 1u4OxmNyauGFfsodYZBFiRNeyXQf34W2KK6H3DFBIYDR73xV971qoiIXk/LdSu6Hinkxi0 T+UDhqvBkR7yCRl/widLEXkfrDWjn/v5KZ8mznaIF8yu6tXLUSE6cpeIw3yWzg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N --Apple-Mail=_3667A5D8-3CF2-47DF-86A9-AE2ACDD12B2D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On 6 Feb 2022, at 16:41, Shawn Webb wrote: >=20 > On Sun, Feb 06, 2022 at 03:26:00PM +0000, Dimitry Andric wrote: >> The branch main has been updated by dim: >>=20 >> URL: = https://cgit.FreeBSD.org/src/commit/?id=3De17fede8ff4629b5ff640ed660940b04= c70da0b6 >>=20 >> commit e17fede8ff4629b5ff640ed660940b04c70da0b6 >> Author: Dimitry Andric >> AuthorDate: 2022-02-06 15:25:11 +0000 >> Commit: Dimitry Andric >> CommitDate: 2022-02-06 15:25:25 +0000 >>=20 >> Fix too small sscanf output buffers in kbdmap >>=20 >> This fixes the following warnings from clang 14: >>=20 >> usr.sbin/kbdmap/kbdmap.c:241:16: error: 'sscanf' may overflow; = destination buffer in argument 5 has size 20, but the corresponding = specifier may require size 21 [-Werror,-Wfortify-source] >> &a, &b, buf); >> ^ ... > Would commits like this and d310bf3867b4168e57365196c3a31797c0538097 > normally cause SAs? Off-by-one bugs are typically considered security > bugs. In this particular case, you could make /usr/sbin/kdbmap (or its alias /usr/sbin/vidfont) crash, by deliberately corrupting /etc/rc.conf or the various INDEX.keymaps files under /usr/share. But what you would gain from this is unclear, none of these tools are setuid, and you already need to be root to edit those files. In case of /usr/sbin/bootparamd, you could make it crash on a deliberately corrupted /etc/bootparams file. Again, this tool is not setuid, and you can only edit the file if you are root anyway. -Dimitry --Apple-Mail=_3667A5D8-3CF2-47DF-86A9-AE2ACDD12B2D Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.2 iF0EARECAB0WIQR6tGLSzjX8bUI5T82wXqMKLiCWowUCYgAOZwAKCRCwXqMKLiCW o+KaAJ9BgaAIKb07eILs3zN+o6s3AtkWgACfdTmbyFFZoQGxOdR09AoNL6g+6uQ= =dn3c -----END PGP SIGNATURE----- --Apple-Mail=_3667A5D8-3CF2-47DF-86A9-AE2ACDD12B2D--