From nobody Tue Sep 22 17:08:10 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hq64B5skFz6sm4Q for ; Tue, 22 Sep 2026 17:08:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hq64B38jNz3Ggn for ; Tue, 22 Sep 2026 17:08:10 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790096890; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BxSd8UnAoJB1EExFRkXaHqBILgGmmxO8VzjRo/02JyU=; b=q08Gmy4QecNM447KECwKzjXvLeIdo7GcG9m20p+kYe9VvEm1PALRRoCGk5HM3EXYE4kZwc anro2HExbSRU4cXhkxHIs1NL0f1SexYPI1rvVMlPaByiwlBVXGKCG1MdKntsNBYewRg4jF 9eIWArGexhsL8DuD/MV2zdxBpGIbGKFB/DvnQm+zoQbsR4TsdFhqwp0YB7yBlRmxIlHzDV /QHhbXGV4Od1fxxit4n8qfxTQsTPcgyPqDAZD6jQmFqflOGwl0Be+0qWC8pi4rsd0TdchN 0rALz13FQR1J2HlKHwkY1bJ5G6kZOEmdjso3NcpWwBJUokzXx7JijYCfjBicVA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790096890; b=O9WhpArc8lK37EyPOzGhyWhZ/KJrCVizc0ehKr/zJ4JH0bR6w3HIQOeyc7Djx5WsV+0ATc nsnUBg0xD0HgiSfl5qbnt7Nzd8V2nqR/RQNgeLrTjE+hsRvLRJ6E/+4emOj5+PidSTHS1P x/EDCOPRbyk4Z1BX5+noWKBKDUZ8qYb+75Gv3o1Tk4LVHoYywWi+zaqjiQHWZRuGNp7JRe 9TxSd4l3oDDeJESnLkBB+1e/fZzKwKiXrTcG1eD7hjWuig/u7SE+86lDnRgr3bXbZ6yTGr WpsKF6cvrL5iMgHxvdT6vqI4cxAhiFEGsrhw97NFV3ZBi2kSaVPHeEitZ6o52A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790096890; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BxSd8UnAoJB1EExFRkXaHqBILgGmmxO8VzjRo/02JyU=; b=GLUjTr9V4THrVxlv3cOPxSbEv3bHpY2dMDehrCbO+OXn6yNIZq/V2SjXUTqn1RU9fB6/XG b4rsiKwbE6aduP+GVzARwyDhazEM+cBNGyacbvXym90rnGvIjiawJcpLQf4dC7sI2Rc0+/ IUJF2lHaKXqtm22pggw564RRaGw3YrYYz1dH69QR9oX+GLddGWaaBAqFGXFvPMIF8Y9Pjq tK0ZvZMIPo3Uk5Cwj3+/SxVz7Rx+RPVi5upW2FapGmw4Y5EADM3HqyVN56GGGcNDHcVqb3 GCWBeOw7iOCtJxOXOohADczo3xc0F0rhJ6abI6Dmgp3OBnthAr/cx/+0iA05NQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hq64B29fYzFlG for ; Tue, 22 Sep 2026 17:08:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3cfbd by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 22 Sep 2026 17:08:10 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Yudi Yang From: Mark Johnston Subject: git: 627c7660793e - stable/15 - ntb_tool: Bound memory window option strings List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 627c7660793e8587956cfc6845fb5b24ca175473 Auto-Submitted: auto-generated Date: Tue, 22 Sep 2026 17:08:10 +0000 Message-Id: <6ab2b5fa.3cfbd.18ec14f5@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=627c7660793e8587956cfc6845fb5b24ca175473 commit 627c7660793e8587956cfc6845fb5b24ca175473 Author: Yudi Yang AuthorDate: 2026-09-10 21:53:48 +0000 Commit: Mark Johnston CommitDate: 2026-09-22 17:06:52 +0000 ntb_tool: Bound memory window option strings parse_mw_buf() copies option names from privileged sysctl input into eight-byte stack buffers. Unbounded %s conversions permit option tokens longer than seven bytes to write past those buffers before the parser validates them. Limit each conversion to seven characters, leaving space for the terminating NUL. Signed-off-by: Yudi Yang Fixes: 96f556f5044a ("NTB Tool: Test driver for NTB hardware drivers.") Reviewed by: markj MFC after: 1 week (cherry picked from commit 602d1b994a22949fff7e4a87cb6e54d6fbad13b6) --- sys/dev/ntb/test/ntb_tool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/dev/ntb/test/ntb_tool.c b/sys/dev/ntb/test/ntb_tool.c index 5476ed988b32..df4a6863965d 100644 --- a/sys/dev/ntb/test/ntb_tool.c +++ b/sys/dev/ntb/test/ntb_tool.c @@ -458,7 +458,7 @@ parse_mw_buf(char *buf, char *cmd, ssize_t *offset, ssize_t *buf_size, int rc = 0; vs1 = vs2 = vs3 = false; - sscanf(buf, "%c %s %jx %s %jx %s %jx", + sscanf(buf, "%c %7s %jx %7s %jx %7s %jx", cmd, op1, &val1, op2, &val2, op3, &val3); if (*cmd != 'W' && *cmd != 'R')