From nobody Tue Sep 22 14:49:24 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hq3043zjzz6sJxb for ; Tue, 22 Sep 2026 14:49:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hq3043Gf2z4h0K for ; Tue, 22 Sep 2026 14:49:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790088564; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sNg+QLn7jGaM0fGV4MIc4diXsnSSgJ+jhye/px7As20=; b=NvFnVfu2reosp3lH5h4IUypA5wwa1sWvMxoqfPAX4FYkdc4AdfTnzsZofX5WaKQjIoBJT/ +KtqfT+auNjb46t7PlWU1cDKJr9wh8D54dA1fZLtbJZ2wLkZrbZ3NNO+o1v51xr79rc5PQ ile+4CQLhahQmAeVvNaKvpVzZnRTchs7I52vMsvWANa/AnMkCOg0S8FYevSijhvjQ5J2Av QRIHKT5mcOWnX2F9xjfQcMpkJCNcJx0AqnSQXAublYDR+T0G5/ZYP07+teCyaz3VGCNER2 uieED65IAjELAROhYp1Xt+izWIGL/MHGzrZ3XCmiLDeuNm6X93b1UUnsqA7oJA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790088564; b=njnWrGeqTKVCnyHXfMsCjzV9lnXwvZeuaI4710RA4RXOFxMFQzZVxnar0SMZgOchd74oFs MqgpuGTQ/aC8v5Hh1QC87vKG8eFq26eyK8JfEqg6pRcoO3JS9oFGioN9Jk/WTVLIR4/9eY 95KTY8i+PD3jZfEtacm2hIkPwNdWgg9+ETMU29xgYrjI7UxDFOxejRRCwS9Qn/VLt+o4O+ aSwB39A3gNKOxzfIgUaEKIUouIlOm7HMM9VablZc4N+iIZxFD/nxlsZ6hy+smTSvs1sJrN wt/Qs8zYP0/z5KnqPsZbjbrT9e8iEX7HvJ82kFdfJnushZoEieTPUVV1YGMImQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790088564; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sNg+QLn7jGaM0fGV4MIc4diXsnSSgJ+jhye/px7As20=; b=gnEmzAGpGnAuN5yQyE4nsxRrc+71gZklUOlb9cFPKwoZFQ71MQ6TL+PaZaB+yWusgwOmel XQNiq7BzT79YMsmXWE6ZftpR93rarfcCxIKX5zzoKs2ttvAggrYBNAKibLq6Qege8n0sKU sWeLAKuBWTH8UFGjgsq3McjgxXf+xn8lYfLOPE2YbMdzV4pb6ctoYnWc2IelKBStXE6Zop SJSMPHo3Cc3ztqKTmS8kb0DTPAUamg+CZa5BFH6vBn17Ij76ZHB6naQsWH5nmkdlgaKQ0U f3NtpKvMfZumSl+ZbMu7qQymzUs8M8CRBIjHDJLATmG9cAX+swExPZZMQ4o/vA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hq30427mJz19PD for ; Tue, 22 Sep 2026 14:49:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 260ec by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 22 Sep 2026 14:49:24 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Yudi Yang From: Mark Johnston Subject: git: 82007ce5bd23 - stable/14 - ntb_tool: Bound memory window option strings List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 82007ce5bd23ea38fcf6cc2bbd10d8fc560eeb72 Auto-Submitted: auto-generated Date: Tue, 22 Sep 2026 14:49:24 +0000 Message-Id: <6ab29574.260ec.42b27c10@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=82007ce5bd23ea38fcf6cc2bbd10d8fc560eeb72 commit 82007ce5bd23ea38fcf6cc2bbd10d8fc560eeb72 Author: Yudi Yang AuthorDate: 2026-09-10 21:53:48 +0000 Commit: Mark Johnston CommitDate: 2026-09-22 13:01:16 +0000 ntb_tool: Bound memory window option strings parse_mw_buf() copies option names from privileged sysctl input into eight-byte stack buffers. Unbounded %s conversions permit option tokens longer than seven bytes to write past those buffers before the parser validates them. Limit each conversion to seven characters, leaving space for the terminating NUL. Signed-off-by: Yudi Yang Fixes: 96f556f5044a ("NTB Tool: Test driver for NTB hardware drivers.") Reviewed by: markj MFC after: 1 week (cherry picked from commit 602d1b994a22949fff7e4a87cb6e54d6fbad13b6) --- sys/dev/ntb/test/ntb_tool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/dev/ntb/test/ntb_tool.c b/sys/dev/ntb/test/ntb_tool.c index 938253bb78bf..3fce462f8bfe 100644 --- a/sys/dev/ntb/test/ntb_tool.c +++ b/sys/dev/ntb/test/ntb_tool.c @@ -459,7 +459,7 @@ parse_mw_buf(char *buf, char *cmd, ssize_t *offset, ssize_t *buf_size, int rc = 0; vs1 = vs2 = vs3 = false; - sscanf(buf, "%c %s %jx %s %jx %s %jx", + sscanf(buf, "%c %7s %jx %7s %jx %7s %jx", cmd, op1, &val1, op2, &val2, op3, &val3); if (*cmd != 'W' && *cmd != 'R')