git: 911bda7cffbf - main - hastd: Ensure nvpair padding is initialized

From: Dag-Erling Smørgrav <des_at_FreeBSD.org>
Date: Sat, 05 Sep 2026 15:44:44 UTC
The branch main has been updated by des:

URL: https://cgit.FreeBSD.org/src/commit/?id=911bda7cffbf358c4e83ea05cfe980d429aff61c

commit 911bda7cffbf358c4e83ea05cfe980d429aff61c
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2026-09-05 15:44:05 +0000
Commit:     Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2026-09-05 15:44:34 +0000

    hastd: Ensure nvpair padding is initialized
    
    The proto-libnv implementation embedded in hastd pads names and values
    out to the nearest multiple of eight bytes, but leaves the padding
    uninitialized, leaking up to 14 bytes of recycled heap per pair in a
    message.
    
    While here, switch from bcopy() to memcpy().
    
    MFC after:      3 days
    Reviewed by:    kevans, emaste
    Differential Revision:  https://reviews.freebsd.org/D59343
---
 sbin/hastd/nv.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sbin/hastd/nv.c b/sbin/hastd/nv.c
index 16ab95cf0dc6..87d59c6929b9 100644
--- a/sbin/hastd/nv.c
+++ b/sbin/hastd/nv.c
@@ -500,7 +500,7 @@ nv_get_##type(struct nv *nv, const char *namefmt, ...)			\
 		return (0);						\
 	PJDLOG_ASSERT((nvh->nvh_type & NV_ORDER_MASK) == NV_ORDER_HOST);\
 	PJDLOG_ASSERT(sizeof(value) == nvh->nvh_dsize);			\
-	bcopy(NVH_DATA(nvh), &value, sizeof(value));			\
+	memcpy(&value, NVH_DATA(nvh), sizeof(value));			\
 									\
 	return (value);							\
 }
@@ -767,7 +767,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type,
 
 	namesize = strlen(name) + 1;
 
-	nvh = malloc(sizeof(*nvh) + roundup2(namesize, 8));
+	nvh = calloc(1, sizeof(*nvh) + roundup2(namesize, 8));
 	if (nvh == NULL) {
 		if (nv->nv_error == 0)
 			nv->nv_error = ENOMEM;
@@ -776,7 +776,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type,
 	nvh->nvh_type = NV_ORDER_HOST | type;
 	nvh->nvh_namesize = (uint8_t)namesize;
 	nvh->nvh_dsize = (uint32_t)vsize;
-	bcopy(name, nvh->nvh_name, namesize);
+	memcpy(nvh->nvh_name, name, namesize);
 
 	/* Add header first. */
 	if (ebuf_add_tail(nv->nv_ebuf, nvh, NVH_HSIZE(nvh)) == -1) {