git: 627c7660793e - stable/15 - ntb_tool: Bound memory window option strings

The branch stable/15 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=627c7660793e8587956cfc6845fb5b24ca175473

commit 627c7660793e8587956cfc6845fb5b24ca175473
Author:     Yudi Yang <yudi.yang@rice.edu>
AuthorDate: 2026-09-10 21:53:48 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-09-22 17:06:52 +0000

    ntb_tool: Bound memory window option strings
    
    parse_mw_buf() copies option names from privileged sysctl input into
    eight-byte stack buffers.  Unbounded %s conversions permit option tokens
    longer than seven bytes to write past those buffers before the parser
    validates them.
    
    Limit each conversion to seven characters, leaving space for the
    terminating NUL.
    
    Signed-off-by: Yudi Yang <yudi.yang@rice.edu>
    
    Fixes:          96f556f5044a ("NTB Tool: Test driver for NTB hardware drivers.")
    Reviewed by:    markj
    MFC after:      1 week
    
    (cherry picked from commit 602d1b994a22949fff7e4a87cb6e54d6fbad13b6)
---
 sys/dev/ntb/test/ntb_tool.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/dev/ntb/test/ntb_tool.c b/sys/dev/ntb/test/ntb_tool.c
index 5476ed988b32..df4a6863965d 100644
--- a/sys/dev/ntb/test/ntb_tool.c
+++ b/sys/dev/ntb/test/ntb_tool.c
@@ -458,7 +458,7 @@ parse_mw_buf(char *buf, char *cmd, ssize_t *offset, ssize_t *buf_size,
 	int rc = 0;
 
 	vs1 = vs2 = vs3 = false;
-	sscanf(buf, "%c %s %jx %s %jx %s %jx",
+	sscanf(buf, "%c %7s %jx %7s %jx %7s %jx",
 	    cmd, op1, &val1, op2, &val2, op3, &val3);
 
 	if (*cmd != 'W' && *cmd != 'R')