From nobody Mon Oct 19 18:54:07 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j7l7z5Vwxz6vr56 for ; Mon, 19 Oct 2026 18:54:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4j7l7z3Xj6z4spV for ; Mon, 19 Oct 2026 18:54:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792436047; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=j4aJ7rzs8Bv2gieyCZVaIz3Wlgzulr6WyP2pxHfRw4I=; b=IRcjP1Jt7m/996Nmt4441wjj0S8NTYccihNZEMEDBNr27GgNGT7iN77VuRSaftfqhujVdP 10HKuL4if4ac0tpDH3ZMb+rilft7PsG1rjxRmN1VzFaN8lTax3O/tfIzUXrijqCLL6OPRo mpUImXbuuGLUq8d5/N5lqojFGRn7u6o3tN5C693UlH/GM+7JG9wbgWdIHUSgjBczJuI2Dx uzy8hUwgGS2xUhbOHR9Z+MMlDVF4JPCATFIC/2G3cDIQ2W97tS2fDXzwIRZXNRQzExNnmS wsI4Yt+qLCERzCXYsNv57rq81f0mXgGNc6pLmpy5+HG1IFYwtgd+0P5Ot/216g== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792436047; b=Qn0Xzyuovc9NFUpH21cAFYHEoSBMcPH4gse6bZFCPVWUBAFCFe3PyZywAJVJxQCLnzX5T9 nmHiDftkhhoqalmnPrXUjSR+C5Jl+pViiyYJVJYQXBdO/7Ke7yC07vHZTZTUCygU3jeBWu a3ecskyev5JriYboGKH5IxTGLeJ7DsY3qnt9A98qTy9vPz2vsM5kFi2fJfagtVQuT1VcXY cVarFnNoDR3AhqeufJLPcXARwjBjcieyO81mqnFAAcyw6vvHyTRxk5KYA8SpuCwaxQxHat Nfsb8Sje+NS7v7rNEFA3fvTjADA6LC+jLUb30wfMgWNsZA+lFnBNiCSy0T6vUw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792436047; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=j4aJ7rzs8Bv2gieyCZVaIz3Wlgzulr6WyP2pxHfRw4I=; b=BYq91CIGJWpUINgAtea5WxYUoZYhnzFI3AFS+vUNjZqvbM6x4CjWBBp+fJCTpi+T5aBctE o4mLIkePSx2IzXXBK5B4GB+UNX7ZH9oXMFLl0kgTkYQZ2B9LIQQZV24xw74g6xkFrzuyVR xSZ0hvIOtybNmhRJPvrX1ICOjPPecDIbM7TLoTe2SLYEYlE06Ki2k528PYt1iro7XQEoGX CZX2bDCW57te7wjpSDBQHs20/x4q3jgYL+ubc5m9XjFe1SCksbKTpzIXz/4YDvNNVz1v8V VlADuOcg+l2v7XgIhwawufLoGeY42cyCAyPS/ri3mhY00/Yc43FfgHFw3qF2fg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j7l7z2x0CzYsk for ; Mon, 19 Oct 2026 18:54:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 32bb5 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 19 Oct 2026 18:54:07 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Osvaldo Janeri Filho From: Mark Johnston Subject: git: 5ce0ab735526 - main - bhyve: fix integer overflow in qXfer packet parser List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: Commit messages for the main branch of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 5ce0ab7355264d38fcde4684f0a64347ec0f5234 Auto-Submitted: auto-generated Date: Mon, 19 Oct 2026 18:54:07 +0000 Message-Id: <6ad6674f.32bb5.3b77b6d5@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=5ce0ab7355264d38fcde4684f0a64347ec0f5234 commit 5ce0ab7355264d38fcde4684f0a64347ec0f5234 Author: Osvaldo Janeri Filho AuthorDate: 2026-10-19 18:53:05 +0000 Commit: Mark Johnston CommitDate: 2026-10-19 18:53:53 +0000 bhyve: fix integer overflow in qXfer packet parser doff + dlen overflows unsigned int when both values are close to UINT_MAX, causing the wrong branch to execute and passing an unbounded length to append_binary_data(). Rewrite the comparison to avoid the addition. Reviewed by: markj Fixes: f81cdf24ba54 ("bhyve: Add support for XML register definitions") MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D60847 --- usr.sbin/bhyve/gdb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr.sbin/bhyve/gdb.c b/usr.sbin/bhyve/gdb.c index c0e9a1547271..3f5c511b820f 100644 --- a/usr.sbin/bhyve/gdb.c +++ b/usr.sbin/bhyve/gdb.c @@ -1841,7 +1841,7 @@ gdb_query(const uint8_t *data, size_t len) start_packet(); if (doff >= xmllen) { append_char('l'); - } else if (doff + dlen >= xmllen) { + } else if (dlen >= xmllen - doff) { append_char('l'); append_binary_data(xml + doff, xmllen - doff); } else {