From nobody Wed Oct 14 16:04:07 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j4bc76xLcz6vmXD for ; Wed, 14 Oct 2026 16:04:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j4bc75V57z4ZxC for ; Wed, 14 Oct 2026 16:04:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791993847; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=3315JwFcPvBUl9uzZUcdLpTAzP1STvUzTpJV7UD056c=; b=N95UEJWLUWlGlju/eWH3Xh0bX3pGJUQ4vviQ1WgMovd26JEseYSpevMEFCIRtJpNwQ+6hL JfKjz9v3W4z2cbyc97n6mVQ2uEVB4N6qMs5W6pmaIoLwWjx4Ns3CyTs49MoO7AWAmYhhfm iWRmOa0tOmFiRi1ZPbRql007a4iBj8ewgETCKDkLosx3bPVmPCxdtRSD8P7o8RncHKSIDD ous9SJn/wAtJ3CguTde9dskT3zxVAQoAhjomA21xoJVKttUwYfMWVQ5J16zWeoiX5uh8vL A6TbPcoTXQeUB9ZlmALPmo7puw7WS6TloSRnsHxsF/L2hdHmT0LjRc8zqc3vEw== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791993847; b=PAyfywAODD2N6daqzL7qkVsAxIacU6XhaPY7BNGUse37HYjoQWw3rJx4dpPdRCvfK2I47a ideXIyFW34vBmK/Tm52rI7vx2y1+HNx0lRgDjszkyfIlP1jXpyGNmMD4ej+aWzSKQLsMoB pJEfcc4+7LnyDIlsmJ7Q21L6TXGbx1avPXotUYH62tFHoFzO6lj75BAj5GClWvjE5NeZDO ayoNB8CckUP2HS4vEBRkJsfkmvEdIs5WLGKiOtmv9grmlNCUY9jXSumYyUo9bx3PoLzOdI DKtgjEcVJJY4vYD/TMdYEcn6Wmz/oBPImQbN5X+n6Eb/RRQY4JhDcBGl9/HgVg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791993847; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=3315JwFcPvBUl9uzZUcdLpTAzP1STvUzTpJV7UD056c=; b=PMx1n2Ng/q1f8hP0nHc5fp5SOUG3gDmivz3Q4VYib4OjwNCby4lBRqgj7pdxgrSMSlxk+5 0cUqJWcLG00YoZ7jZdPKoJ9xSchYYDcNIn8XmU4URP0VXlNdoL5Vl3utanKhilidPWyikU /gKNYyjTE2YpYUxkMznWXXkNoXeIH3pQvxAhSNHUd8YHmFE/B8xJs7nmJEB9r+V2hyjV1d MXtLOuTWFVu2iIERHscS051DWit2UZ1iBXEWRLwBw6679I2JD9Fuk5I2TUElk3nc58Hyq8 9722vUvsHZcLpjhhuO1Hv1la7kLbrUg0rRwUXXjqT3uH/KsX5n1iASiX6cuHqw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j4bc74WRyz18Tb for ; Wed, 14 Oct 2026 16:04:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 27a2e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 14 Oct 2026 16:04:07 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Dag-Erling=?utf-8?Q? Sm=C3=B8rg?=rav From: Mark Johnston Subject: git: c192c6e54d5d - releng/14.5 - hastd: Ensure nvpair padding is initialized List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.5 X-Git-Reftype: branch X-Git-Commit: c192c6e54d5daa946385bb167d48152bbd683bb0 Auto-Submitted: auto-generated Date: Wed, 14 Oct 2026 16:04:07 +0000 Message-Id: <6acfa7f7.27a2e.18b718e7@gitrepo.freebsd.org> The branch releng/14.5 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c192c6e54d5daa946385bb167d48152bbd683bb0 commit c192c6e54d5daa946385bb167d48152bbd683bb0 Author: Dag-Erling Smørgrav AuthorDate: 2026-09-05 15:44:05 +0000 Commit: Mark Johnston CommitDate: 2026-10-13 14:03:00 +0000 hastd: Ensure nvpair padding is initialized The proto-libnv implementation embedded in hastd pads names and values out to the nearest multiple of eight bytes, but leaves the padding uninitialized, leaking up to 14 bytes of recycled heap per pair in a message. While here, switch from bcopy() to memcpy(). Approved by: so Security: FreeBSD-EN-26:26.hastd MFC after: 3 days Reviewed by: kevans, emaste Differential Revision: https://reviews.freebsd.org/D59343 (cherry picked from commit 911bda7cffbf358c4e83ea05cfe980d429aff61c) (cherry picked from commit e4b16e786847c42f6079ac8f0dea9ca9161ace52) --- sbin/hastd/nv.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sbin/hastd/nv.c b/sbin/hastd/nv.c index 4e50d0026e7b..e25ad7bbd826 100644 --- a/sbin/hastd/nv.c +++ b/sbin/hastd/nv.c @@ -501,7 +501,7 @@ nv_get_##type(struct nv *nv, const char *namefmt, ...) \ return (0); \ PJDLOG_ASSERT((nvh->nvh_type & NV_ORDER_MASK) == NV_ORDER_HOST);\ PJDLOG_ASSERT(sizeof(value) == nvh->nvh_dsize); \ - bcopy(NVH_DATA(nvh), &value, sizeof(value)); \ + memcpy(&value, NVH_DATA(nvh), sizeof(value)); \ \ return (value); \ } @@ -768,7 +768,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type, namesize = strlen(name) + 1; - nvh = malloc(sizeof(*nvh) + roundup2(namesize, 8)); + nvh = calloc(1, sizeof(*nvh) + roundup2(namesize, 8)); if (nvh == NULL) { if (nv->nv_error == 0) nv->nv_error = ENOMEM; @@ -777,7 +777,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type, nvh->nvh_type = NV_ORDER_HOST | type; nvh->nvh_namesize = (uint8_t)namesize; nvh->nvh_dsize = (uint32_t)vsize; - bcopy(name, nvh->nvh_name, namesize); + memcpy(nvh->nvh_name, name, namesize); /* Add header first. */ if (ebuf_add_tail(nv->nv_ebuf, nvh, NVH_HSIZE(nvh)) == -1) {