From nobody Tue Sep 15 13:54:59 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hkk6c5K1tz6sG3h for ; Tue, 15 Sep 2026 13:55:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hkk6c4lcvz4Ccw for ; Tue, 15 Sep 2026 13:55:04 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789480504; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wVNdt2KaqfMlgrrQv/tcxDyVGGA+eX5Zc5uxOHhi3pk=; b=QDn9eulR/rWPzp8kHwDcbTodGfDOsQ274qSK8z4smiJz5EuRFbsWmaknG3mXknuMvV06F3 JSrtVbtA9MYpgzV9B3GUJw684BWDi3SY4zvMDWFVql/8FGFF6jKyytMS27ba7GnQ7b2k5w +C1Y7C8/8GGh2pG+Cffzzg2j72Ws0VtodQsuM3FL+EooTa7RHkQdt1Vf1ZbYR6pHiq3H2H 6T3exR3V8uUA+DkB/sfEqFFy/zfxFTRdN3YApfgzHUX8L02zLNp681/0wQBRoJgS62dqVH 2L0GtMnQIiuxmxkdrx7315lR5YRye4YYNTmUYXB3ZkZZz1QCk041A3yTreEt2Q== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1789480504; b=MZ7C6bleKzzVibITujcm9purTU87e7Ca4eNp95Nz8rcYLcXsXDZHr41XlX0wzMkuKHOqrx KTyZ5OS55oHnSQaFNusCwVjqL0g7X+ubG8ddXuSYNDwDXyZ9rOAtPLgDYYqXIVAiN7w0l/ yzix6FpS7AZtGx7iTWaDMwaJ66b9oqshTaWaitdLKUIInkGyDBVH8/i+W1FsH+MDA2SCbn AajS8jSD7/IDS/8OA6URH4RnvCyLNo1DOr0+KIg47BtIj6aKAcbb4FL7M2dCMdmrzww6J/ X6uSNEipbiMXUxrOaSCZWCRr58f3lQnN2mEISd30W14q0ELFsqPwrhx56R3iSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789480504; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wVNdt2KaqfMlgrrQv/tcxDyVGGA+eX5Zc5uxOHhi3pk=; b=HsU0fZyizuxph3i4HGZS1bqdR+wwKCLA69HKHRnyPN3JFY0H9VO68u1vnDxYxcl82V/HYD U5/zqE3crDsEW5R7QIlw1fnSW01+RAUaOnnTk9H/OExo+j1HLpcU2CuBkgM3IqmxpPlgK4 RaPol9w7/r38OKT+J0gMvujeiN4RqO7B+Wb16qOrPXlcL8cY/DOgWJqKNbLGkun+mx0tGs aIsT4Vb/4ZKfBSGnKpi4VW5p1fQj9o/T8WOZpEOcuLZZeRpUoeHk9ZGJZZ3L2C1/tfeX9U x9WuaMxipBpGH2L96U/Toq3VoeMCLSZmX3D82SFeixuSysKa+J0z0HOiGI0JRA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hkk6c3pJQz13QT for ; Tue, 15 Sep 2026 13:55:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 322b4 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 15 Sep 2026 13:54:59 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Yudi Yang From: Mark Johnston Subject: git: 602d1b994a22 - main - ntb_tool: Bound memory window option strings List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 602d1b994a22949fff7e4a87cb6e54d6fbad13b6 Auto-Submitted: auto-generated Date: Tue, 15 Sep 2026 13:54:59 +0000 Message-Id: <6aa94e33.322b4.1a5c3e31@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=602d1b994a22949fff7e4a87cb6e54d6fbad13b6 commit 602d1b994a22949fff7e4a87cb6e54d6fbad13b6 Author: Yudi Yang AuthorDate: 2026-09-10 21:53:48 +0000 Commit: Mark Johnston CommitDate: 2026-09-15 13:49:47 +0000 ntb_tool: Bound memory window option strings parse_mw_buf() copies option names from privileged sysctl input into eight-byte stack buffers. Unbounded %s conversions permit option tokens longer than seven bytes to write past those buffers before the parser validates them. Limit each conversion to seven characters, leaving space for the terminating NUL. Signed-off-by: Yudi Yang Fixes: 96f556f5044a ("NTB Tool: Test driver for NTB hardware drivers.") Reviewed by: markj MFC after: 1 week --- sys/dev/ntb/test/ntb_tool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/dev/ntb/test/ntb_tool.c b/sys/dev/ntb/test/ntb_tool.c index 5476ed988b32..df4a6863965d 100644 --- a/sys/dev/ntb/test/ntb_tool.c +++ b/sys/dev/ntb/test/ntb_tool.c @@ -458,7 +458,7 @@ parse_mw_buf(char *buf, char *cmd, ssize_t *offset, ssize_t *buf_size, int rc = 0; vs1 = vs2 = vs3 = false; - sscanf(buf, "%c %s %jx %s %jx %s %jx", + sscanf(buf, "%c %7s %jx %7s %jx %7s %jx", cmd, op1, &val1, op2, &val2, op3, &val3); if (*cmd != 'W' && *cmd != 'R')