git: b5e57452b62e - main - bsnmp: zero-fill the destination on a short ASN.1 IpAddress

The branch main has been updated by maxim:

URL: https://cgit.FreeBSD.org/src/commit/?id=b5e57452b62e7c185706ed8b2a86e9f8ac483357

commit b5e57452b62e7c185706ed8b2a86e9f8ac483357
Author:     Osvaldo Janeri Filho <ojanerif@amd.com>
AuthorDate: 2026-10-29 18:05:14 +0000
Commit:     Maxim Konovalov <maxim@FreeBSD.org>
CommitDate: 2026-10-29 20:58:10 +0000

    bsnmp: zero-fill the destination on a short ASN.1 IpAddress
    
    asn_get_ipaddress_raw() meant to pad the 4-byte buffer after a short
    copy, but the loop bound was the already-reached len and never ran,
    leaving addr[len..3] uninitialised.  Pad to 4.
    
    This is harmless for the in-tree consumers (bsnmpd(1) and
    libbsnmpclient) which zero the PDU before decoding it.
    
    Reviewed by:    harti, maxim
    Approved by:    harti
    MFC after:      2 weeks
    
    Differential Revision:  https://reviews.freebsd.org/D60923
---
 contrib/bsnmp/lib/asn1.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contrib/bsnmp/lib/asn1.c b/contrib/bsnmp/lib/asn1.c
index f1f9267c0226..5f2419e8ba1a 100644
--- a/contrib/bsnmp/lib/asn1.c
+++ b/contrib/bsnmp/lib/asn1.c
@@ -777,7 +777,7 @@ asn_get_ipaddress_raw(struct asn_buf *b, asn_len_t len, u_char *addr)
 		asn_error(b, "short length for ip-Address %u", len);
 		for (i = 0; i < len; i++)
 			*addr++ = *b->asn_cptr++;
-		while (i++ < len)
+		while (i++ < 4)
 			*addr++ = 0;
 		b->asn_len -= len;
 		return (ASN_ERR_BADLEN);