From nobody Mon Oct 26 19:47:05 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jD3zt3ZFzz6xWsg for ; Mon, 26 Oct 2026 19:47:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jD3zt0vTfz4qyp for ; Mon, 26 Oct 2026 19:47:06 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793044026; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rJcWewW+nfpgAQlQacES5v7WZJSxNjv8bfy8OMu23A8=; b=PupfHBdPS+/qezic9pVTMi7I4af6T5DK93AkqP8UzOCnVbie6Dfj4PEpWUt0bEVLdQ4j71 iXqiL7oC0WnuDUHAD09TL/3WMGDS88jg1UyWWs+vDhqPo/4+a5gog93z1i2Tg/iQtAJ01C OzAueE7PHLPbeFa8nkO8UOlgBDWi0ehuiboXZ35ZL7qQVEX/dLhva0PcpU1KG0mEYQmStW 1e/Icht9E5Gsp/sUC1STs7VuaVcgrCAX/pwg/sW8Z4x7Ak/whwNfsfDjPCEIQIUj/jx6HD fDWIMbFFNHZtRACKTHJoWi7s6qpJslZxz63aUIQFjcPcZ4/wCVTe1GIxtB8EyQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793044026; b=cqzCGTXby8HHL2SH6R1QDBk9g84FCrvGv1LfVc9oV+wOA8BJbtfGhy0ljDAqsDeTpBvtkW lNpn+Csc/8bSzNt2axcyVbuNWf7yV6pblyLE+2izW2AAKAfGHnSikWqWN9t63pnYZ/UAs3 +fPZANaFzKP3yWi2zpiIVj98qe3RDcxhHKM57JGmJMyWyD2QeIHtAPoRXwc53YU2HvS+dF lOY/k5pSt1sYfeWWoP13c2VbIWTqZJPGW6vQYCbv7ovh2NBvX6aV3Blr8l4yEqAyyrbfG6 QRzUfR7ZH3W16fNQebaepH/CuFAIMx9Dm2uqtbhXXMlMZJnKJVkNh3BnYGLsDw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793044026; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rJcWewW+nfpgAQlQacES5v7WZJSxNjv8bfy8OMu23A8=; b=FJnUJYK55qeLfLTqO+46KnuJ/U57qEKPakqiAOuoGYrw++NRNXFymNgMh3oEhKb52v8aoI 26PxVxbxcV0XqK/buUHlmCO4vel0RZ2R3B4AOgXmP4Fc38jggbmIOXWIZN/cnVXFJKYT1/ 0PqIupNxa5ephhUjcwGRIK6TkKOpu/3XcVzfCXcsjsDJz5r4GopSxPOfUvLM8Y8EOOnwcY YChK0GK86iQrORoGO8wcH7XM9NT7v8L+dOaKuasaKgVchYU12MyqBKf7GDbi7cXiUJ8uQe 9aMQp/TsecdS1bieR6npdnHoDgjW/lO849xqlgPGeJDYghEqHbozfXG8aWfqQw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jD3zt00xjzntr for ; Mon, 26 Oct 2026 19:47:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 37540 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 26 Oct 2026 19:47:05 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Osvaldo Janeri Filho From: Mark Johnston Subject: git: d5d386df28b4 - stable/14 - bhyve: fix integer overflow in qXfer packet parser List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: d5d386df28b45e170c6151e483d4b0593735d134 Auto-Submitted: auto-generated Date: Mon, 26 Oct 2026 19:47:05 +0000 Message-Id: <6adfae39.37540.193afe4e@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=d5d386df28b45e170c6151e483d4b0593735d134 commit d5d386df28b45e170c6151e483d4b0593735d134 Author: Osvaldo Janeri Filho AuthorDate: 2026-10-19 18:53:05 +0000 Commit: Mark Johnston CommitDate: 2026-10-26 14:35:02 +0000 bhyve: fix integer overflow in qXfer packet parser doff + dlen overflows unsigned int when both values are close to UINT_MAX, causing the wrong branch to execute and passing an unbounded length to append_binary_data(). Rewrite the comparison to avoid the addition. Reviewed by: markj Fixes: f81cdf24ba54 ("bhyve: Add support for XML register definitions") MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D60847 (cherry picked from commit 5ce0ab7355264d38fcde4684f0a64347ec0f5234) --- usr.sbin/bhyve/gdb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr.sbin/bhyve/gdb.c b/usr.sbin/bhyve/gdb.c index abdc64a4a75a..5464b71f9304 100644 --- a/usr.sbin/bhyve/gdb.c +++ b/usr.sbin/bhyve/gdb.c @@ -1695,7 +1695,7 @@ gdb_query(const uint8_t *data, size_t len) start_packet(); if (doff >= xmllen) { append_char('l'); - } else if (doff + dlen >= xmllen) { + } else if (dlen >= xmllen - doff) { append_char('l'); append_binary_data(xml + doff, xmllen - doff); } else {