git: b5839f51f80a - releng/15.1 - hastd: Ensure nvpair padding is initialized

The branch releng/15.1 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=b5839f51f80adf341af52cd8c860c4e6d6aaa12a

commit b5839f51f80adf341af52cd8c860c4e6d6aaa12a
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2026-09-05 15:44:05 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-10-13 14:10:21 +0000

    hastd: Ensure nvpair padding is initialized
    
    The proto-libnv implementation embedded in hastd pads names and values
    out to the nearest multiple of eight bytes, but leaves the padding
    uninitialized, leaking up to 14 bytes of recycled heap per pair in a
    message.
    
    While here, switch from bcopy() to memcpy().
    
    Approved by:    so
    Security:       FreeBSD-EN-26:26.hastd
    MFC after:      3 days
    Reviewed by:    kevans, emaste
    Differential Revision:  https://reviews.freebsd.org/D59343
    
    (cherry picked from commit 911bda7cffbf358c4e83ea05cfe980d429aff61c)
    (cherry picked from commit 0d0f40cd29d2aba7bfeef8861b73930bbb84308e)
---
 sbin/hastd/nv.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sbin/hastd/nv.c b/sbin/hastd/nv.c
index 16ab95cf0dc6..87d59c6929b9 100644
--- a/sbin/hastd/nv.c
+++ b/sbin/hastd/nv.c
@@ -500,7 +500,7 @@ nv_get_##type(struct nv *nv, const char *namefmt, ...)			\
 		return (0);						\
 	PJDLOG_ASSERT((nvh->nvh_type & NV_ORDER_MASK) == NV_ORDER_HOST);\
 	PJDLOG_ASSERT(sizeof(value) == nvh->nvh_dsize);			\
-	bcopy(NVH_DATA(nvh), &value, sizeof(value));			\
+	memcpy(&value, NVH_DATA(nvh), sizeof(value));			\
 									\
 	return (value);							\
 }
@@ -767,7 +767,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type,
 
 	namesize = strlen(name) + 1;
 
-	nvh = malloc(sizeof(*nvh) + roundup2(namesize, 8));
+	nvh = calloc(1, sizeof(*nvh) + roundup2(namesize, 8));
 	if (nvh == NULL) {
 		if (nv->nv_error == 0)
 			nv->nv_error = ENOMEM;
@@ -776,7 +776,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type,
 	nvh->nvh_type = NV_ORDER_HOST | type;
 	nvh->nvh_namesize = (uint8_t)namesize;
 	nvh->nvh_dsize = (uint32_t)vsize;
-	bcopy(name, nvh->nvh_name, namesize);
+	memcpy(nvh->nvh_name, name, namesize);
 
 	/* Add header first. */
 	if (ebuf_add_tail(nv->nv_ebuf, nvh, NVH_HSIZE(nvh)) == -1) {