From nobody Wed Oct 14 16:03:49 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j4bbp21b1z6vmfH for ; Wed, 14 Oct 2026 16:03:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j4bbn6wB6z4ZdN for ; Wed, 14 Oct 2026 16:03:49 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791993830; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wO57of4KIZmH8wjiEdddjtyKeybcjf1yO24H+r5NBIc=; b=ATRGXICQiZrJJf7OhgRX/hPQHUX7YUc7JIPWlFHx34oV2STXMDYfuFvOBfNrrq5QVcPtrH Uc42Z7wX0A0OoLr+/R2+EmLeix97Y/de//Jkq+Co7G52ldM0uJmhYHIklSFXpEiw92PAFy v+0F9mTQN65jmQ1WaHHSKAqZG2gfzWPcLX1qtTFG567914paLp4OAG8rJqptIwmuy57+5b sLAvu0s7Ce2NpvBm1vSLsFdud+NLsfj4NMFtYMZNbRiX0ZVPoEHokzxwXj81GUqR3i8Zve aoGCsf/CFvvyDlAduflxGfgR/uBXIxxwvuasdHTTfFwedB1SBNiTG55gPXsgMg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791993830; b=c3vMUCllirvGNe0vHOB/xMeM3IYSrzwMrkFIYVCYsNkSMivErKQIw6T2SvbUj1zGG3hMrI 9FGDzJJY8aCt1qnv7An1+e2plzkDxYtjAqWe5DtDLFTo4JsiWJhitr71iEcHnxtKbM6KMK iWR8Qw0xxUDFlNmbPx2pLz5zaHHbIzR4sxBKxp1C6j7eiqvemjfjQ8JZMt2MBLblh819Ol TLqKCV97+UxTgEQSVl4FlG0/yez/U/EDU85KsO+I7h0KaFF18mQjVr06jfPIRvojHK/s3C csYAEAtkMTIcwQUG/x11Vgl/xUdZF0fhspUTLC6nsOuNkPaqf3VfIvfx0tIYmA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791993830; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wO57of4KIZmH8wjiEdddjtyKeybcjf1yO24H+r5NBIc=; b=xAyV2rnEwlPIk9UdsruLndZSleb5UGB0WZ81/VgIKQyf+3NHZTAbYwLnvLCSyv3CTXeWMS /kJzON3gtoFzMn9MrERWSLzCBHFQkf/8oNJ/otXpBn/mndIel81I/1glPAF/EC07J1Tr9M VIOkDPiq7agM07C4dg2ysygrUOAL2snfJOrjLoSp+DRD9UmUyr00HkL1DJM1W2w3VJidy2 Snos24FD3uS+5tZuuIHKxNwc6MK52r9fGGzvNQC4KbX22qf5couxJ6JJ542Shrg9ENeynJ wiUqZ0tILkV4WrT/zTMFOoCEdoXqeOGzDyR/D/RCSSEkWcbiip/NYfHZW4p+bg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j4bbn5kYYz18Fb for ; Wed, 14 Oct 2026 16:03:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 277bb by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 14 Oct 2026 16:03:49 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Dag-Erling=?utf-8?Q? Sm=C3=B8rg?=rav From: Mark Johnston Subject: git: e1d55e72b362 - releng/14.4 - hastd: Ensure nvpair padding is initialized List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: e1d55e72b36295a8703f562e432b0d2ce6922591 Auto-Submitted: auto-generated Date: Wed, 14 Oct 2026 16:03:49 +0000 Message-Id: <6acfa7e5.277bb.6172ae6@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=e1d55e72b36295a8703f562e432b0d2ce6922591 commit e1d55e72b36295a8703f562e432b0d2ce6922591 Author: Dag-Erling Smørgrav AuthorDate: 2026-09-05 15:44:05 +0000 Commit: Mark Johnston CommitDate: 2026-10-13 13:47:11 +0000 hastd: Ensure nvpair padding is initialized The proto-libnv implementation embedded in hastd pads names and values out to the nearest multiple of eight bytes, but leaves the padding uninitialized, leaking up to 14 bytes of recycled heap per pair in a message. While here, switch from bcopy() to memcpy(). Approved by: so Security: FreeBSD-EN-26:26.hastd MFC after: 3 days Reviewed by: kevans, emaste Differential Revision: https://reviews.freebsd.org/D59343 (cherry picked from commit 911bda7cffbf358c4e83ea05cfe980d429aff61c) (cherry picked from commit e4b16e786847c42f6079ac8f0dea9ca9161ace52) --- sbin/hastd/nv.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sbin/hastd/nv.c b/sbin/hastd/nv.c index 4e50d0026e7b..e25ad7bbd826 100644 --- a/sbin/hastd/nv.c +++ b/sbin/hastd/nv.c @@ -501,7 +501,7 @@ nv_get_##type(struct nv *nv, const char *namefmt, ...) \ return (0); \ PJDLOG_ASSERT((nvh->nvh_type & NV_ORDER_MASK) == NV_ORDER_HOST);\ PJDLOG_ASSERT(sizeof(value) == nvh->nvh_dsize); \ - bcopy(NVH_DATA(nvh), &value, sizeof(value)); \ + memcpy(&value, NVH_DATA(nvh), sizeof(value)); \ \ return (value); \ } @@ -768,7 +768,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type, namesize = strlen(name) + 1; - nvh = malloc(sizeof(*nvh) + roundup2(namesize, 8)); + nvh = calloc(1, sizeof(*nvh) + roundup2(namesize, 8)); if (nvh == NULL) { if (nv->nv_error == 0) nv->nv_error = ENOMEM; @@ -777,7 +777,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type, nvh->nvh_type = NV_ORDER_HOST | type; nvh->nvh_namesize = (uint8_t)namesize; nvh->nvh_dsize = (uint32_t)vsize; - bcopy(name, nvh->nvh_name, namesize); + memcpy(nvh->nvh_name, name, namesize); /* Add header first. */ if (ebuf_add_tail(nv->nv_ebuf, nvh, NVH_HSIZE(nvh)) == -1) {