git: e1d55e72b362 - releng/14.4 - hastd: Ensure nvpair padding is initialized

The branch releng/14.4 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=e1d55e72b36295a8703f562e432b0d2ce6922591

commit e1d55e72b36295a8703f562e432b0d2ce6922591
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2026-09-05 15:44:05 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-10-13 13:47:11 +0000

    hastd: Ensure nvpair padding is initialized
    
    The proto-libnv implementation embedded in hastd pads names and values
    out to the nearest multiple of eight bytes, but leaves the padding
    uninitialized, leaking up to 14 bytes of recycled heap per pair in a
    message.
    
    While here, switch from bcopy() to memcpy().
    
    Approved by:    so
    Security:       FreeBSD-EN-26:26.hastd
    MFC after:      3 days
    Reviewed by:    kevans, emaste
    Differential Revision:  https://reviews.freebsd.org/D59343
    
    (cherry picked from commit 911bda7cffbf358c4e83ea05cfe980d429aff61c)
    (cherry picked from commit e4b16e786847c42f6079ac8f0dea9ca9161ace52)
---
 sbin/hastd/nv.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sbin/hastd/nv.c b/sbin/hastd/nv.c
index 4e50d0026e7b..e25ad7bbd826 100644
--- a/sbin/hastd/nv.c
+++ b/sbin/hastd/nv.c
@@ -501,7 +501,7 @@ nv_get_##type(struct nv *nv, const char *namefmt, ...)			\
 		return (0);						\
 	PJDLOG_ASSERT((nvh->nvh_type & NV_ORDER_MASK) == NV_ORDER_HOST);\
 	PJDLOG_ASSERT(sizeof(value) == nvh->nvh_dsize);			\
-	bcopy(NVH_DATA(nvh), &value, sizeof(value));			\
+	memcpy(&value, NVH_DATA(nvh), sizeof(value));			\
 									\
 	return (value);							\
 }
@@ -768,7 +768,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type,
 
 	namesize = strlen(name) + 1;
 
-	nvh = malloc(sizeof(*nvh) + roundup2(namesize, 8));
+	nvh = calloc(1, sizeof(*nvh) + roundup2(namesize, 8));
 	if (nvh == NULL) {
 		if (nv->nv_error == 0)
 			nv->nv_error = ENOMEM;
@@ -777,7 +777,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type,
 	nvh->nvh_type = NV_ORDER_HOST | type;
 	nvh->nvh_namesize = (uint8_t)namesize;
 	nvh->nvh_dsize = (uint32_t)vsize;
-	bcopy(name, nvh->nvh_name, namesize);
+	memcpy(nvh->nvh_name, name, namesize);
 
 	/* Add header first. */
 	if (ebuf_add_tail(nv->nv_ebuf, nvh, NVH_HSIZE(nvh)) == -1) {