From nobody Thu Oct 29 12:10:48 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jFjk56KqNz6wvYM for ; Thu, 29 Oct 2026 12:10:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jFjk54r8tz4Gft for ; Thu, 29 Oct 2026 12:10:53 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793275853; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FtfHM8fJkqXhSBttKhADB4noBFCS0CkPf4ZWDb1xjz8=; b=GX6vcpzmFmFOf4CBtKh9+75BGGulUylZkE7iGsCtOM5uWcIMpaygqau2f0kzuncyy9jkZK ri25CNT/e3S1Os8rxXdv4gIAKGNAbmEcoczYKHqy9Z3CTjnZHpIR6R9rnOEdPoo9EYz1u+ pFXKLOr2TbGYvMCm/V80ANnDbGqwLBfZST8APTQmEjy0xtUnuKorT8GgCQJwTRkdxkcssg 7oOp4RTLJuuLbwH/y4ir2GXn2hYVp45aWXhG5EQiD6uRCzTR7ehiP/a37uHyMizxSi4r/W ApzdAUC7gN3Pr1AGfkYWZY6nkN8qIMaHJpZcw8CO4l6dKRbUyEPLjpAGxRcBFw== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793275853; b=BOiG1eaE2JkrkAloem9G1NZF0uDSNC+eBFreKapSERxXnJNTMe6t2JM0Xj+nq01Oq2ORwV Sg+u45H0gBSUD2+nWg5z559jDWwLmN5LjnHnNhuw+HspYVB5iGUTyOGLq4zH9A8KDhe8HD B/HxWcOvf5xkUX7Ct04/9v56Y+7cKEmLaVuKsMAqr2QaRUitrv7XZB3fe4MzQI2fcC9u2S 2Qh86yzwzYSDnHI7VedojlE/OY5rvYOxBHrQp+7QB7ab+92m+oyH7r12DjxhsP7UqAH3r9 xbQr3YsiLRdLi4sdCSKiO17OBRFRdcabnzFJ80XacpjC2KQUJANbUOMMeGuiKA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793275853; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FtfHM8fJkqXhSBttKhADB4noBFCS0CkPf4ZWDb1xjz8=; b=sI1J+KQKvfQuHVmMYuNaI+2FcnaYjZ87Wjztz6GCVtoPVSbGz3GdnnZi9nY2KDinkEd19v cJcFyRpS32MKGLnIZlSjvwHVj8fHqCQnGk8dCKWCgKw1eweZvNNtVLmxEAEADTwDO8hVJa 8xBxyvxjVW7s9V39H2znxYrhb7CaN9zxuk7Y2dHdnNVMmlxrSQcsBoxui9BLifNKanNiqQ hkPrw5T+c3ovnisq7nAbCcGJ1YulKj4hSLu4R62BgX8wU4xbfxdS8+EhupE3FmDZGDwgRH frF3EbokYdy9Br+RBcYmbwmRyYZPMZfXYJCoLuquKwF81cTNl6I0jJwu2vlN9Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jFjk54VtjzgBV for ; Thu, 29 Oct 2026 12:10:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 38e48 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 29 Oct 2026 12:10:48 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Faraz Vahedi Subject: git: 13bcc9a88260 - main - libc: Fix stack buffer overflow in cgetnext() List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kfv X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 13bcc9a882603da216c7c38c086fcb501bd9d0ec Auto-Submitted: auto-generated Date: Thu, 29 Oct 2026 12:10:48 +0000 Message-Id: <6ae337c8.38e48.60b48417@gitrepo.freebsd.org> The branch main has been updated by kfv: URL: https://cgit.FreeBSD.org/src/commit/?id=13bcc9a882603da216c7c38c086fcb501bd9d0ec commit 13bcc9a882603da216c7c38c086fcb501bd9d0ec Author: Faraz Vahedi AuthorDate: 2026-07-05 15:03:31 +0000 Commit: Faraz Vahedi CommitDate: 2026-10-29 12:09:45 +0000 libc: Fix stack buffer overflow in cgetnext() `cgetnext()` copies a capability record's name field into a fixed 1024 byte on-stack buffer (`nbuf[BSIZE]`) one character at a time, but never checks that the write pointer stays within the buffer. Therefore, a record name that is longer than `BSIZE` (either on a single line, or accumulated across several `\`-continued lines as the pointer is not reset amidst continuation) writes past the end of `nbuf` and smashes the stack. The name field is read directly from the capability file, so any consumer of `cgetnext()`/`cgetfirst()` that processes an untrusted `termcap(5)`- or `printcap(5)`-style database (e.g. `cap_mkdb(1)`, `lpr(1)`, or any third-party caller) can be exposed and hence made to corrupt the stack. Reviewed by: fuz, dteske Approved by: fuz (mentor), dteske (mentor) MFC after: 1 week Pull Request: https://github.com/freebsd/freebsd-src/pull/2309 --- lib/libc/gen/getcap.3 | 20 ++++++++++++++++++-- lib/libc/gen/getcap.c | 5 +++++ 2 files changed, 23 insertions(+), 2 deletions(-) diff --git a/lib/libc/gen/getcap.3 b/lib/libc/gen/getcap.3 index 00c7edd8026f..9edf947877fc 100644 --- a/lib/libc/gen/getcap.3 +++ b/lib/libc/gen/getcap.3 @@ -28,7 +28,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd March 22, 2002 +.Dd July 23, 2026 .Dt GETCAP 3 .Os .Sh NAME @@ -258,7 +258,10 @@ expansion, \-1 is returned if a system error occurred, and \-2 is returned if a potential reference loop is detected (see .Ic tc= comments below). -Upon completion of database (0 return) the database is closed. +Upon completion of database (0 return) or occurrence of an error (negative +return), the database is closed and a subsequent call to +.Fn cgetnext +starts again from the first record. .Pp The .Fn cgetclose @@ -550,6 +553,19 @@ as follows: .It Bq Er ENOMEM No memory to allocate. .El +.Pp +The +.Fn cgetfirst +and +.Fn cgetnext +functions +may fail and set +.Va errno +as follows: +.Bl -tag -width Er +.It Bq Er ENAMETOOLONG +The name field of a capability record is too long. +.El .Sh SEE ALSO .Xr cap_mkdb 1 , .Xr malloc 3 diff --git a/lib/libc/gen/getcap.c b/lib/libc/gen/getcap.c index cfb81ed0d065..1ee83c8ca28b 100644 --- a/lib/libc/gen/getcap.c +++ b/lib/libc/gen/getcap.c @@ -709,6 +709,11 @@ cgetnext(char **bp, char **db_array) np = nbuf; for (;;) { for (cp = line; *cp != '\0'; cp++) { + if (np >= nbuf + sizeof(nbuf) - 1) { + (void)cgetclose(); + errno = ENAMETOOLONG; + return (-1); + } if (*cp == ':') { *np++ = ':'; done = 1;