From nobody Tue Sep 22 21:50:10 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hqDKg3lG0z6t7Xj for ; Tue, 22 Sep 2026 21:50:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hqDKg3H04z3C6Z for ; Tue, 22 Sep 2026 21:50:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790113815; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=p/iztACMmJq7a7JCao4qUZflNjUPN1mdD0m1jbgzGZY=; b=nEXxSX0qRKgOhvQIuXVBNiRpRbRB+7bMQqTEkiFTjwaRma9+f58twr+h3+Cez+cuBlSH/n 4y2k0hQPw0qTo+vJtmS/KYHKbAGmRbOSmEdB1wgnOgpgY1APwHrnrfGF/P9GnOWB8kc/Z8 /NZuFHbSzRf6cK2jrrFAUHZT6l5PyvztFeAXm/yN4Gwte2VEgYaJLjoIqIHLj5RsMTVRV5 ZC8nL/dOsVxj37BS3VgXMvs+BTepHaD4Ndc7D7r1gd1wUQwT6/SSo4rga1MhrNsh3c5CTh /lNv75pOEm92Pf1DP7wISfzzASxjbhgI6HALLLUQhoHIczgoPhCsS1p6vWKPvA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790113815; b=DwQAtGsCKocSGKdl4n5eP6Rk5lv1Hs1RpO+LIbrTURIDlH7XS2xE/j5Q1Js59Ev/KrbOut AKotmzTuoSlPn7xEXuvKxSljzDStSTsVyD3/l7OzCxZzQUWWtnTIPNnd324N68GTGyFOGX qSzndtIrtAKctX9KokIuFW8bXHacQAfDX2aI5CaOs1+g+QI8pikrEUjXIvYfRAlgfIwgRk fP+VDYTxKHtQA06emJUeYEKrXJxphQKQDu1tjqOby2xpLTjxACM5NcqMseDfnp3szZhkYK BqZ7QqXkBRW7K/87305lM6IuEyXvWsf6K0IP9ATcdqyDwH2SaQaONDkEKum2lg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790113815; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=p/iztACMmJq7a7JCao4qUZflNjUPN1mdD0m1jbgzGZY=; b=ZnOSCzYg0WWhoryPSnrXKUry0CJal/+6qo+5qeksCAA8zuiqKUzg4qazc66S4f3mrGOfE7 ApgjKOWNO6VOAshjVZV6qrnICrj9+oax5wDy1FUmIR0nbYKUIlUu4kQLmdDTKuHLuUBKxb SyoUuCkR2ZFmg1M9EOROLpLtMHlzJXXyw+chQcpwpKUzI5YLzBCnyWf/ZW4xs5smKQCVeB SUr4j6fU7HG62DLldzYpItn8Nq9Au80se9TGGTcEHZ5jM8Sw3MtafoiTh9kK8BAQVvphcB qph7mr8bj+YkSWbWbTO7uYxdQLkHInU7epXDtwLfOoxT7asgbADvGk5hBcgf0Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hqDKg2LTCzP2S for ; Tue, 22 Sep 2026 21:50:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 33ac0 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 22 Sep 2026 21:50:10 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Maxim Konovalov Subject: git: 296e3fd54ca8 - main - bsnmp: validate the lower bound of error_index in responses List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: maxim X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 296e3fd54ca8972fa6696974097a2f2705f8dfc4 Auto-Submitted: auto-generated Date: Tue, 22 Sep 2026 21:50:10 +0000 Message-Id: <6ab2f812.33ac0.b14b6e8@gitrepo.freebsd.org> The branch main has been updated by maxim: URL: https://cgit.FreeBSD.org/src/commit/?id=296e3fd54ca8972fa6696974097a2f2705f8dfc4 commit 296e3fd54ca8972fa6696974097a2f2705f8dfc4 Author: Maxim Konovalov AuthorDate: 2026-09-22 21:32:43 +0000 Commit: Maxim Konovalov CommitDate: 2026-09-22 21:32:43 +0000 bsnmp: validate the lower bound of error_index in responses Check if the response's error_index is within a sane interval. Otherwise, a rogue peer could crash us. PR: 298222 Reported by: Robert Morris Reviewed by: markj Discussed with: secteam (markj) MFC after: 2 weeks Analyzed with: Claude Code Opus 5 --- usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c | 8 ++++++-- usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c | 3 ++- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c b/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c index 9252e63749bb..25129567ee92 100644 --- a/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c +++ b/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c @@ -413,7 +413,9 @@ snmptool_get(struct snmp_toolinfo *snmptoolctx) * Loop through the object list and set object->error to the * varbinding that caused the error. */ - if (snmp_object_seterror(snmptoolctx, + if (resp.error_index < 1 || + resp.error_index > (int32_t)resp.nbindings || + snmp_object_seterror(snmptoolctx, &(resp.bindings[resp.error_index - 1]), resp.error_status) <= 0) { snmp_pdu_free(&resp); @@ -1107,7 +1109,9 @@ snmptool_set(struct snmp_toolinfo *snmptoolctx) break; } - if (snmp_object_seterror(snmptoolctx, + if (resp.error_index < 1 || + resp.error_index > (int32_t)resp.nbindings || + snmp_object_seterror(snmptoolctx, &(resp.bindings[resp.error_index - 1]), resp.error_status) <= 0) { snmp_pdu_free(&resp); diff --git a/usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c b/usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c index d8fbb55290a8..4c53555407de 100644 --- a/usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c +++ b/usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c @@ -1993,7 +1993,8 @@ snmp_output_err_resp(struct snmp_toolinfo *snmptoolctx, struct snmp_pdu *pdu) struct snmp_object *object; char buf[ASN_OIDSTRLEN]; - if (pdu == NULL || (pdu->error_index > (int32_t) pdu->nbindings)) { + if (pdu == NULL || pdu->error_index < 1 || + (pdu->error_index > (int32_t) pdu->nbindings)) { fprintf(stdout, "Invalid error index in PDU\n"); return; }