git: e4b16e786847 - stable/14 - hastd: Ensure nvpair padding is initialized

The branch stable/14 has been updated by des:

URL: https://cgit.FreeBSD.org/src/commit/?id=e4b16e786847c42f6079ac8f0dea9ca9161ace52

commit e4b16e786847c42f6079ac8f0dea9ca9161ace52
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2026-09-05 15:44:05 +0000
Commit:     Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2026-09-20 16:51:17 +0000

    hastd: Ensure nvpair padding is initialized
    
    The proto-libnv implementation embedded in hastd pads names and values
    out to the nearest multiple of eight bytes, but leaves the padding
    uninitialized, leaking up to 14 bytes of recycled heap per pair in a
    message.
    
    While here, switch from bcopy() to memcpy().
    
    MFC after:      3 days
    Reviewed by:    kevans, emaste
    Differential Revision:  https://reviews.freebsd.org/D59343
    
    (cherry picked from commit 911bda7cffbf358c4e83ea05cfe980d429aff61c)
---
 sbin/hastd/nv.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sbin/hastd/nv.c b/sbin/hastd/nv.c
index 4e50d0026e7b..e25ad7bbd826 100644
--- a/sbin/hastd/nv.c
+++ b/sbin/hastd/nv.c
@@ -501,7 +501,7 @@ nv_get_##type(struct nv *nv, const char *namefmt, ...)			\
 		return (0);						\
 	PJDLOG_ASSERT((nvh->nvh_type & NV_ORDER_MASK) == NV_ORDER_HOST);\
 	PJDLOG_ASSERT(sizeof(value) == nvh->nvh_dsize);			\
-	bcopy(NVH_DATA(nvh), &value, sizeof(value));			\
+	memcpy(&value, NVH_DATA(nvh), sizeof(value));			\
 									\
 	return (value);							\
 }
@@ -768,7 +768,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type,
 
 	namesize = strlen(name) + 1;
 
-	nvh = malloc(sizeof(*nvh) + roundup2(namesize, 8));
+	nvh = calloc(1, sizeof(*nvh) + roundup2(namesize, 8));
 	if (nvh == NULL) {
 		if (nv->nv_error == 0)
 			nv->nv_error = ENOMEM;
@@ -777,7 +777,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type,
 	nvh->nvh_type = NV_ORDER_HOST | type;
 	nvh->nvh_namesize = (uint8_t)namesize;
 	nvh->nvh_dsize = (uint32_t)vsize;
-	bcopy(name, nvh->nvh_name, namesize);
+	memcpy(nvh->nvh_name, name, namesize);
 
 	/* Add header first. */
 	if (ebuf_add_tail(nv->nv_ebuf, nvh, NVH_HSIZE(nvh)) == -1) {