Re: git: f5ea3dce2cbe - main - libnv: switch fd_wait() from select(2) to poll(2)

On Fri, May 01, 2026 at 04:11:48PM -0400, Mark Johnston wrote:
> On Fri, May 01, 2026 at 09:11:17AM +0100, Oliver Pinter wrote:
> > On Wednesday, April 29, 2026, Mark Johnston <markj@freebsd.org> wrote:
> > 
> > > The branch main has been updated by markj:
> > >
> > > URL: https://cgit.FreeBSD.org/src/commit/?id=
> > > f5ea3dce2cbe1ee2068c5e5c11bb066f5789685b
> > >
> > > commit f5ea3dce2cbe1ee2068c5e5c11bb066f5789685b
> > > Author:     Mariusz Zaborski <oshogbo@FreeBSD.org>
> > > AuthorDate: 2026-04-28 14:35:10 +0000
> > > Commit:     Mark Johnston <markj@FreeBSD.org>
> > > CommitDate: 2026-04-29 14:39:28 +0000
> > >
> > >     libnv: switch fd_wait() from select(2) to poll(2)
> > >
> > >     The previous implementation used FD_SET() on a stack-allocated fd_set,
> > >     which is an out-of-bounds write whenever the socket fd is >= FD_SETSIZE
> > >     (1024).
> > 
> > 
> > This problem seems like a more generic problem, after looking into
> > sys/select.h
> > 
> > What about adding a check for the FD_SET about the variable is on the stack
> > or not? And enforce the FD_SETSIZE limit almost the same way as it is
> > already done with fortify source.
> 
> FORTIFY_SOURCE would automatically detect the addition of out-of-bounds
> fds, so as a mitigation I would like to propose enabling it by default.

As a small data point, HardenedBSD has set _FORTIFY_SOURCE=2 for both
src and ports (integrated back when Kyle Evans committed the original
work).

Thanks,

-- 
Shawn Webb
Cofounder / Security Engineer
HardenedBSD

Signal Username:  shawn_webb.74
Tor-ified Signal: +1 303-901-1600 / shawn_webb_opsec.50
https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc