git: 0d0f40cd29d2 - stable/15 - hastd: Ensure nvpair padding is initialized

The branch stable/15 has been updated by des:

URL: https://cgit.FreeBSD.org/src/commit/?id=0d0f40cd29d2aba7bfeef8861b73930bbb84308e

commit 0d0f40cd29d2aba7bfeef8861b73930bbb84308e
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2026-09-05 15:44:05 +0000
Commit:     Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2026-09-20 16:51:12 +0000

    hastd: Ensure nvpair padding is initialized
    
    The proto-libnv implementation embedded in hastd pads names and values
    out to the nearest multiple of eight bytes, but leaves the padding
    uninitialized, leaking up to 14 bytes of recycled heap per pair in a
    message.
    
    While here, switch from bcopy() to memcpy().
    
    MFC after:      3 days
    Reviewed by:    kevans, emaste
    Differential Revision:  https://reviews.freebsd.org/D59343
    
    (cherry picked from commit 911bda7cffbf358c4e83ea05cfe980d429aff61c)
---
 sbin/hastd/nv.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sbin/hastd/nv.c b/sbin/hastd/nv.c
index 16ab95cf0dc6..87d59c6929b9 100644
--- a/sbin/hastd/nv.c
+++ b/sbin/hastd/nv.c
@@ -500,7 +500,7 @@ nv_get_##type(struct nv *nv, const char *namefmt, ...)			\
 		return (0);						\
 	PJDLOG_ASSERT((nvh->nvh_type & NV_ORDER_MASK) == NV_ORDER_HOST);\
 	PJDLOG_ASSERT(sizeof(value) == nvh->nvh_dsize);			\
-	bcopy(NVH_DATA(nvh), &value, sizeof(value));			\
+	memcpy(&value, NVH_DATA(nvh), sizeof(value));			\
 									\
 	return (value);							\
 }
@@ -767,7 +767,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type,
 
 	namesize = strlen(name) + 1;
 
-	nvh = malloc(sizeof(*nvh) + roundup2(namesize, 8));
+	nvh = calloc(1, sizeof(*nvh) + roundup2(namesize, 8));
 	if (nvh == NULL) {
 		if (nv->nv_error == 0)
 			nv->nv_error = ENOMEM;
@@ -776,7 +776,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type,
 	nvh->nvh_type = NV_ORDER_HOST | type;
 	nvh->nvh_namesize = (uint8_t)namesize;
 	nvh->nvh_dsize = (uint32_t)vsize;
-	bcopy(name, nvh->nvh_name, namesize);
+	memcpy(nvh->nvh_name, name, namesize);
 
 	/* Add header first. */
 	if (ebuf_add_tail(nv->nv_ebuf, nvh, NVH_HSIZE(nvh)) == -1) {