From nobody Tue Oct 06 17:39:27 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hzk5q3s7Zz4nGkj for ; Tue, 06 Oct 2026 17:39:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hzk5q2PM1z3Hgc for ; Tue, 06 Oct 2026 17:39:27 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791308367; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=RKnaWUqairifMt+wH/Mp5bk+pijrngpbVMXXwzZl3As=; b=NJ/hJ1o7ZMBVnR3KI+HKiaK3VOYRHB33IX5zjf+jI4azjt/27KilnUTfPj0Z3REa2PE/UH Z77XujsqzEOkEEPiS1DkARRnqbLlcAzcSrf8XNNHe466igjRnluX5sErlj66gfKtINHFY4 EVGJQmBgD7DV+PX2xyFq1ibc3EpW7z9+t/uS/X+RzxfrEvAX7qG00bjKeaW+mb1grnSxEH lqud/2B88j0j66Te1Q9h8wKBpHV6NyebPGkhhMYjDJrTuydnjR04p+GEER5DjtJsurolJF WBbCEgBd96e0OtKtIQm/R+Xx+NgtblL+2G4lv7WUArlRjSxvWY10C8x9poqk+Q== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791308367; b=wN5R6qjOfak4JnlvzSukc/u0cgaPoh8kD0EYTg3ToSu3BN6IQW1TeIM6lYmYQjfh9dBf/m +rGEx2w0kfaV9VcqxUObJbOcbey6wmIGAh1owQuW4zuxSb2neGp7mjoiPzLapP+4ZuNAcK 99F9N6YbXHHAuh0qpoLVWLp9lM0/M3Tgp5Lu8nbNcHLJ326NTVlqdWqYAAuASy1gP259HW KFZCGEqGcGWXQjBlfueuG7ah5MjL3huF2oV29/TyjOFW5KWvL6el2OWTEKfNwfQRvdP334 1ogiLcEf6p9Z4siHPsN636JizM0ogaQbwwE59tOfC6JpWXoReZ4GQVH7KfyuOw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791308367; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=RKnaWUqairifMt+wH/Mp5bk+pijrngpbVMXXwzZl3As=; b=kmNG9ggJiq+dwgDKG0CeSRmMahO0Vds/YR9C9bo2KUsh4O65Mp9I5b9yRtHsN2MGLm/qhW hgrVGFRPNuPWBZ2W3WuyV73Ef5V/uR9MaZ3JoS8G1oC6zYXWTpjjf2I+FDDRdtGWV0fVsi JnKsFlI9SgjwlQZ2/W49IA7vwEBLPIMD7h0eURmzMfmqpErHZkyf++9m+A6XVCFO8NVUdm Mge2Qrcla+qaziBotftylDaFEVkIR7x7yJiHkB8tR/7FPHD93YLrP2RaBdCi640kefzvbT /SsZTxxRnZat4gjYJicrIt4clHc12yffaknetSHZeFT7raxSGkDxNbFql6DYhg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hzk5q1MZ4zG5G for ; Tue, 06 Oct 2026 17:39:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 38176 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 06 Oct 2026 17:39:27 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Maxim Konovalov Subject: git: de5689d1e6ea - stable/15 - bsnmp: validate the lower bound of error_index in responses List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: maxim X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: de5689d1e6ea621249e1ef44db3c2d3ee8431ba5 Auto-Submitted: auto-generated Date: Tue, 06 Oct 2026 17:39:27 +0000 Message-Id: <6ac5324f.38176.36b47706@gitrepo.freebsd.org> The branch stable/15 has been updated by maxim: URL: https://cgit.FreeBSD.org/src/commit/?id=de5689d1e6ea621249e1ef44db3c2d3ee8431ba5 commit de5689d1e6ea621249e1ef44db3c2d3ee8431ba5 Author: Maxim Konovalov AuthorDate: 2026-09-22 21:32:43 +0000 Commit: Maxim Konovalov CommitDate: 2026-10-06 17:37:11 +0000 bsnmp: validate the lower bound of error_index in responses Check if the response's error_index is within a sane interval. Otherwise, a rogue peer could crash us. PR: 298222 Reported by: Robert Morris Reviewed by: markj Discussed with: secteam (markj) MFC after: 2 weeks Analyzed with: Claude Code Opus 5 (cherry picked from commit 296e3fd54ca8972fa6696974097a2f2705f8dfc4) --- usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c | 8 ++++++-- usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c | 3 ++- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c b/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c index 9252e63749bb..25129567ee92 100644 --- a/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c +++ b/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c @@ -413,7 +413,9 @@ snmptool_get(struct snmp_toolinfo *snmptoolctx) * Loop through the object list and set object->error to the * varbinding that caused the error. */ - if (snmp_object_seterror(snmptoolctx, + if (resp.error_index < 1 || + resp.error_index > (int32_t)resp.nbindings || + snmp_object_seterror(snmptoolctx, &(resp.bindings[resp.error_index - 1]), resp.error_status) <= 0) { snmp_pdu_free(&resp); @@ -1107,7 +1109,9 @@ snmptool_set(struct snmp_toolinfo *snmptoolctx) break; } - if (snmp_object_seterror(snmptoolctx, + if (resp.error_index < 1 || + resp.error_index > (int32_t)resp.nbindings || + snmp_object_seterror(snmptoolctx, &(resp.bindings[resp.error_index - 1]), resp.error_status) <= 0) { snmp_pdu_free(&resp); diff --git a/usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c b/usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c index 4d1058629496..857bb205b9b4 100644 --- a/usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c +++ b/usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c @@ -1994,7 +1994,8 @@ snmp_output_err_resp(struct snmp_toolinfo *snmptoolctx, struct snmp_pdu *pdu) struct snmp_object *object; char buf[ASN_OIDSTRLEN]; - if (pdu == NULL || (pdu->error_index > (int32_t) pdu->nbindings)) { + if (pdu == NULL || pdu->error_index < 1 || + (pdu->error_index > (int32_t) pdu->nbindings)) { fprintf(stdout, "Invalid error index in PDU\n"); return; }