From nobody Tue May 19 14:08:47 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gKc3M6xpCz6fFm7 for ; Tue, 19 May 2026 14:08:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gKc3M5WS4z3hDt for ; Tue, 19 May 2026 14:08:47 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1779199727; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=PtCYUaGUcV00VEfG+FUSQRlmkEv3QbQdFpNtpjXYrUw=; b=QmL2ub06NiDq6sQZxrEbVYsyAvMLbjX6j3N+X5J7EVlmR4F97mOcvjNtSMCaP2Zv40MaLV 6EnmQT5mC/T5pkdpkKQa6SZxKE90Y3ChH/jyD3KiAYVqyj2xLABLFbInAFxdRW92FjQclh O4WiC/0zZFjE9K0QZ9k8rMxFkL9Qtk6zrUo8ggLhXBJTVYGe2I7oKMouACQjJRBD/YqSRF Nl9ScNzyYv8AcD5jORE75WffVBxmPOuQx4thUrjL3MYCc4jfQo6/rmZRtW/DoHk+gaSyf2 t4NfrdXtQIkuRasNSVrTI3UiZn5yCWMo7kYNTXBaS1MC4THyXBgpYXJd4Jbadg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1779199727; a=rsa-sha256; cv=none; b=Ofz5gLk4BWuOrYBiVrwgCZqn+lm+STDYjwnbxqDAwlHmgF3NUr/yF5KXrxn13ubcL6h9mt JozRNi4G81a72j/ZRuXZ+HbRfLWThmX31jyvzQnfiIkxqMKDjwnhHNg1NnmWESLZTMrRYm qPrL4vILE6yrnM0fBfP8SKJ7WbS7wun9jUi5YzLwve9M2V64HmESJJ4R284m3lCMlLC2S8 rrYOCTESozNA7ms7NRUPOTG7O7jWP9jDANXRfMbfpxHQ8VQ5xBx0VLdsToidiJQY0dio3b 6DMC/MJk19utdScWga9Dx9T9ToOw+HKzAUoLjknAV++fnf394ZHo/whb77Zbdw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1779199727; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=PtCYUaGUcV00VEfG+FUSQRlmkEv3QbQdFpNtpjXYrUw=; b=Y17CKAlIw+848gnE6o2hxgHIVu1LFM7eyI41UTtVyBw4WoKeOEt2K/xpdJqOHx4Nd4lkfE iTM6Afh2PhxAC0mZrIWczQb7iDnzNVz8CYpt4NBK6z+Lzk3vTmxkWsmXs/TSXG0T7mgpty LF1vPV7DuzAahCi0oVCfPi4sN8d8x+3VyHDTBOChh5m7o6WvQkDX7bzldkAWJl5zkF0WEs U1I5TzjxLxFiuqk88seSa9JePyhtWONc9sGcyRTqme3zYKijrJ/GXWf4mcVE5nsWsGpe/F hN2XyKwkO5cusclV0zWR+tIwNYQp1//E9cW8r/0Y14Lv8m73A/uBwefebTfs/w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gKc3M4ZYNz2vp for ; Tue, 19 May 2026 14:08:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3afc3 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 19 May 2026 14:08:47 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 27b9d3d016e8 - stable/15 - tests: Add a simple regression test for an execve overflow bug List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 27b9d3d016e8c661afb334087958d481230bf972 Auto-Submitted: auto-generated Date: Tue, 19 May 2026 14:08:47 +0000 Message-Id: <6a0c6eef.3afc3.49eaea48@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=27b9d3d016e8c661afb334087958d481230bf972 commit 27b9d3d016e8c661afb334087958d481230bf972 Author: Mark Johnston AuthorDate: 2026-05-04 15:39:55 +0000 Commit: Mark Johnston CommitDate: 2026-05-19 14:08:32 +0000 tests: Add a simple regression test for an execve overflow bug MFC after: 2 weeks (cherry picked from commit 41b03932e59068decf03b7975889841f71c73ec4) --- tests/sys/kern/Makefile | 1 + tests/sys/kern/execve_overflow.c | 46 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 47 insertions(+) diff --git a/tests/sys/kern/Makefile b/tests/sys/kern/Makefile index 3786b87e0474..6adb2dab02c9 100644 --- a/tests/sys/kern/Makefile +++ b/tests/sys/kern/Makefile @@ -18,6 +18,7 @@ ATF_TESTS_C+= kern_copyin ATF_TESTS_C+= kern_descrip_test # One test modifies the maxfiles limit, which can cause spurious test failures. TEST_METADATA.kern_descrip_test+= is_exclusive="true" +PLAIN_TESTS_C+= execve_overflow ATF_TESTS_C+= exterr_test ATF_TESTS_C+= fdgrowtable_test ATF_TESTS_C+= getdirentries_test diff --git a/tests/sys/kern/execve_overflow.c b/tests/sys/kern/execve_overflow.c new file mode 100644 index 000000000000..462f36ac5154 --- /dev/null +++ b/tests/sys/kern/execve_overflow.c @@ -0,0 +1,46 @@ +/* + * Copyright (c) 2026 Mark Johnston + * + * SPDX-License-Identifier: BSD-2-Clause + */ + +/* + * A minimal regression test for FreeBSD-SA-26:13.exec. + */ + +#include +#include +#include +#include +#include +#include + +#define SCRIPTNAME "script" +#define SCRIPTBODY "#!/bin/sh\nexit 0\n" + +int +main(void) +{ + char *argv; + size_t size; + int fd; + + fd = open(SCRIPTNAME, O_WRONLY | O_CREAT | O_TRUNC, 0700); + if (fd == -1) + err(1, "open"); + if (write(fd, SCRIPTBODY, sizeof(SCRIPTBODY) - 1) != + sizeof(SCRIPTBODY) - 1) + err(1, "write"); + close(fd); + + size = ARG_MAX / 2; + argv = malloc(size); + if (argv == NULL) + err(1, "malloc"); + memset(argv, 'a', size - 1); + argv[size - 1] = '\0'; + + execve(SCRIPTNAME, (char *[]){ argv, NULL }, (char *[]){ NULL }); + + exit(1); +}