git: 0a7dd3d960c8 - releng/14.4 - tests/libalias: Add a regression test for an alias_smedia bug

The branch releng/14.4 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=0a7dd3d960c8f31112db30ed69f0503ed99f077f

commit 0a7dd3d960c8f31112db30ed69f0503ed99f077f
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-06-22 17:25:56 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-06-29 19:17:30 +0000

    tests/libalias: Add a regression test for an alias_smedia bug
    
    Approved by:    so
    Security:       FreeBSD-SA-26:41.libalias
    Security:       CVE-2026-49420
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D57747
---
 tests/sys/netinet/libalias/Makefile |  4 ++
 tests/sys/netinet/libalias/smedia.c | 74 +++++++++++++++++++++++++++++++++++++
 2 files changed, 78 insertions(+)

diff --git a/tests/sys/netinet/libalias/Makefile b/tests/sys/netinet/libalias/Makefile
index 20d904511538..5f83eaee9900 100644
--- a/tests/sys/netinet/libalias/Makefile
+++ b/tests/sys/netinet/libalias/Makefile
@@ -4,6 +4,10 @@ PACKAGE=	tests
 TESTSDIR=	${TESTSBASE}/sys/netinet/libalias
 BINDIR=		${TESTSDIR}
 
+PLAIN_TESTS_C+=	smedia
+
+LIBADD.smedia+=	sbuf
+
 ATF_TESTS_C+=	1_instance	\
 		2_natout	\
 		3_natin		\
diff --git a/tests/sys/netinet/libalias/smedia.c b/tests/sys/netinet/libalias/smedia.c
new file mode 100644
index 000000000000..e181a7a538af
--- /dev/null
+++ b/tests/sys/netinet/libalias/smedia.c
@@ -0,0 +1,74 @@
+/*
+ * Copyright (c) 2026 The FreeBSD Foundation
+ *
+ * This software was developed by Mark Johnston under sponsorship from
+ * the FreeBSD Foundation.
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+/*
+ * A minimal regression test for a buffer overflow in alias_rtsp_out().
+ */
+
+#include <sys/types.h>
+#include <sys/sbuf.h>
+
+#include <arpa/inet.h>
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include <netinet/tcp_var.h>
+
+#include <stdlib.h>
+#include <string.h>
+
+#include <alias.h>
+
+int
+main(void)
+{
+	uint8_t *packet;
+	struct ip ip;
+	struct tcphdr tcp;
+	struct sbuf sb;
+	struct libalias *la;
+
+	sbuf_new(&sb, NULL, 0, SBUF_AUTOEXTEND);
+	sbuf_printf(&sb, "SETUP rtsp://example.com/media.mp4 RTSP/1.0\r\n");
+	sbuf_printf(&sb, "CSeq: 1\r\n");
+	sbuf_printf(&sb, "Transport: RTP/AVP;unicast;");
+	for (int i = 0; i < 200; i++)
+		sbuf_printf(&sb, "client_port=%d-%d;", 2 * i, 2 * i + 1);
+	sbuf_printf(&sb, "\r\n\r\n");
+	sbuf_finish(&sb);
+
+	memset(&tcp, 0, sizeof(tcp));
+	tcp.th_sport = htons(1234);
+	tcp.th_dport = htons(554);
+	tcp.th_off = 5;
+
+	memset(&ip, 0, sizeof(ip));
+	ip.ip_v = IPVERSION;
+	ip.ip_hl = sizeof(ip) / 4;
+	ip.ip_len = htons(sizeof(ip) + sizeof(tcp) + sbuf_len(&sb));
+	ip.ip_id = htons(1);
+	ip.ip_ttl = 64;
+	ip.ip_p = IPPROTO_TCP;
+	ip.ip_src.s_addr = inet_addr("127.0.0.1");
+	ip.ip_dst.s_addr = inet_addr("127.0.0.2");
+
+	packet = malloc(sizeof(ip) + sizeof(tcp) + sbuf_len(&sb));
+	memcpy(packet, &ip, sizeof(ip));
+	memcpy(packet + sizeof(ip), &tcp, sizeof(tcp));
+	memcpy(packet + sizeof(ip) + sizeof(tcp), sbuf_data(&sb),
+	    sbuf_len(&sb));
+
+	la = LibAliasInit(NULL);
+	LibAliasSetAddress(la,
+	    (struct in_addr){.s_addr = inet_addr("127.0.0.1")});
+	if (LibAliasOut(la, packet, sizeof(ip) + sizeof(tcp) + sbuf_len(&sb)) !=
+	    PKT_ALIAS_OK)
+		return (1);
+	LibAliasUninit(la);
+	return (0);
+}