git: 82007ce5bd23 - stable/14 - ntb_tool: Bound memory window option strings

The branch stable/14 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=82007ce5bd23ea38fcf6cc2bbd10d8fc560eeb72

commit 82007ce5bd23ea38fcf6cc2bbd10d8fc560eeb72
Author:     Yudi Yang <yudi.yang@rice.edu>
AuthorDate: 2026-09-10 21:53:48 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-09-22 13:01:16 +0000

    ntb_tool: Bound memory window option strings
    
    parse_mw_buf() copies option names from privileged sysctl input into
    eight-byte stack buffers.  Unbounded %s conversions permit option tokens
    longer than seven bytes to write past those buffers before the parser
    validates them.
    
    Limit each conversion to seven characters, leaving space for the
    terminating NUL.
    
    Signed-off-by: Yudi Yang <yudi.yang@rice.edu>
    
    Fixes:          96f556f5044a ("NTB Tool: Test driver for NTB hardware drivers.")
    Reviewed by:    markj
    MFC after:      1 week
    
    (cherry picked from commit 602d1b994a22949fff7e4a87cb6e54d6fbad13b6)
---
 sys/dev/ntb/test/ntb_tool.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/dev/ntb/test/ntb_tool.c b/sys/dev/ntb/test/ntb_tool.c
index 938253bb78bf..3fce462f8bfe 100644
--- a/sys/dev/ntb/test/ntb_tool.c
+++ b/sys/dev/ntb/test/ntb_tool.c
@@ -459,7 +459,7 @@ parse_mw_buf(char *buf, char *cmd, ssize_t *offset, ssize_t *buf_size,
 	int rc = 0;
 
 	vs1 = vs2 = vs3 = false;
-	sscanf(buf, "%c %s %jx %s %jx %s %jx",
+	sscanf(buf, "%c %7s %jx %7s %jx %7s %jx",
 	    cmd, op1, &val1, op2, &val2, op3, &val3);
 
 	if (*cmd != 'W' && *cmd != 'R')