git: 602d1b994a22 - main - ntb_tool: Bound memory window option strings

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=602d1b994a22949fff7e4a87cb6e54d6fbad13b6

commit 602d1b994a22949fff7e4a87cb6e54d6fbad13b6
Author:     Yudi Yang <yudi.yang@rice.edu>
AuthorDate: 2026-09-10 21:53:48 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-09-15 13:49:47 +0000

    ntb_tool: Bound memory window option strings
    
    parse_mw_buf() copies option names from privileged sysctl input into
    eight-byte stack buffers.  Unbounded %s conversions permit option tokens
    longer than seven bytes to write past those buffers before the parser
    validates them.
    
    Limit each conversion to seven characters, leaving space for the
    terminating NUL.
    
    Signed-off-by: Yudi Yang <yudi.yang@rice.edu>
    
    Fixes:          96f556f5044a ("NTB Tool: Test driver for NTB hardware drivers.")
    Reviewed by:    markj
    MFC after:      1 week
---
 sys/dev/ntb/test/ntb_tool.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/dev/ntb/test/ntb_tool.c b/sys/dev/ntb/test/ntb_tool.c
index 5476ed988b32..df4a6863965d 100644
--- a/sys/dev/ntb/test/ntb_tool.c
+++ b/sys/dev/ntb/test/ntb_tool.c
@@ -458,7 +458,7 @@ parse_mw_buf(char *buf, char *cmd, ssize_t *offset, ssize_t *buf_size,
 	int rc = 0;
 
 	vs1 = vs2 = vs3 = false;
-	sscanf(buf, "%c %s %jx %s %jx %s %jx",
+	sscanf(buf, "%c %7s %jx %7s %jx %7s %jx",
 	    cmd, op1, &val1, op2, &val2, op3, &val3);
 
 	if (*cmd != 'W' && *cmd != 'R')