From nobody Tue Sep 22 21:50:10 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hqDKZ3lFfz6t7md for ; Tue, 22 Sep 2026 21:50:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hqDKZ3CKVz3C1Z for ; Tue, 22 Sep 2026 21:50:10 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790113810; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=p/iztACMmJq7a7JCao4qUZflNjUPN1mdD0m1jbgzGZY=; b=M09VP5whGj0o7+35psRev5WBuAGDIwaqt+i9LpG/Gki8P2dD2n5/hplnNK7l/goe2b+NdP IlGckHYlnHYVHHKu1jx9Hqxsla7/vRtrp+JHWjq95thj2bqVrQJNs7UbqR5hzp0TlEP5+f n0qkf3EHWpOBXRR9OpAPJekIWHeeh3Q2UMU8HVuPseFQ0Unf/ASTASFwqZSy8TivXcu9Pw PGmSzfo8HPLrYlJHTouNuL0JmvrXJ9f4IllxL/bs2brMvqnF+PdtPSyHa70fIf9RXQ5qNz VpYnOTAx9CMiASZ5ogHxJygvpQh14cHPcNGoHKhl9ouolPsa7kWqnMJUZymg8Q== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790113810; b=Nwd2xKuWPrqqzPQ2saLPSgNXfb/IFyMPhKhN/P5FnzcCfQelQJiF5s1n8XJpWxEBP9MXdO Bz50UveUpV1CsTGEipWPS871Sc80wapNTWn1IpeF5hhBapxRnBbSIuTvq6ad677ZukrX6G 0b5S6anzsV9uxwqs02V4PS1/4OQJ6ZHRc21ShqcGmRtsg8kb9nGyb27Lbm/O4D0FGwnee9 4sOnbwoVjNrtDj7hFERt5b86B8XK6fZARBpb+lbCduKYCbseAfLoeTeLPjgJR0lHQiJT/w Khnp/5KJSo8bE2n3ffS6zImM5Qc+853seWV40KcJcjX2QqqBSXEHdobhs8cAww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790113810; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=p/iztACMmJq7a7JCao4qUZflNjUPN1mdD0m1jbgzGZY=; b=STTnymdHekkscT1OU7aKBoOH/z5TVeSN+F0L0IjRGHHjMbvk79MDcqQSb/QPwzaMZ6uaST HxlkCMQDHe8vrLv0PC64zvaBsRBXgPWf7O95BKrv1gx1slDVTxWX0Jrs3yw0BkvlU1EMyj 9ctvVGSVfUUFhdLahewLss+lLU0Wx6u9Q9mLw/eYigSvkdsJH7klqo+aejRjPwIeZ96Q6a JdmdtlF9ci2kfyD2uoPz6G0IKrKgqohuA2jARo7AylaiocqzQ/NXwOlAHYu86PNbjuJq87 qtJj5CV9oJuN8Rkr4gueU6T35iN87cxkRX5N1tMeDWkHVVFgAWKkjXVIMG8v/g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hqDKZ2HFrzPM0 for ; Tue, 22 Sep 2026 21:50:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 33ac0 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 22 Sep 2026 21:50:10 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Maxim Konovalov Subject: git: 296e3fd54ca8 - main - bsnmp: validate the lower bound of error_index in responses List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: maxim X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 296e3fd54ca8972fa6696974097a2f2705f8dfc4 Auto-Submitted: auto-generated Date: Tue, 22 Sep 2026 21:50:10 +0000 Message-Id: <6ab2f812.33ac0.b14b6e8@gitrepo.freebsd.org> The branch main has been updated by maxim: URL: https://cgit.FreeBSD.org/src/commit/?id=296e3fd54ca8972fa6696974097a2f2705f8dfc4 commit 296e3fd54ca8972fa6696974097a2f2705f8dfc4 Author: Maxim Konovalov AuthorDate: 2026-09-22 21:32:43 +0000 Commit: Maxim Konovalov CommitDate: 2026-09-22 21:32:43 +0000 bsnmp: validate the lower bound of error_index in responses Check if the response's error_index is within a sane interval. Otherwise, a rogue peer could crash us. PR: 298222 Reported by: Robert Morris Reviewed by: markj Discussed with: secteam (markj) MFC after: 2 weeks Analyzed with: Claude Code Opus 5 --- usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c | 8 ++++++-- usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c | 3 ++- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c b/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c index 9252e63749bb..25129567ee92 100644 --- a/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c +++ b/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c @@ -413,7 +413,9 @@ snmptool_get(struct snmp_toolinfo *snmptoolctx) * Loop through the object list and set object->error to the * varbinding that caused the error. */ - if (snmp_object_seterror(snmptoolctx, + if (resp.error_index < 1 || + resp.error_index > (int32_t)resp.nbindings || + snmp_object_seterror(snmptoolctx, &(resp.bindings[resp.error_index - 1]), resp.error_status) <= 0) { snmp_pdu_free(&resp); @@ -1107,7 +1109,9 @@ snmptool_set(struct snmp_toolinfo *snmptoolctx) break; } - if (snmp_object_seterror(snmptoolctx, + if (resp.error_index < 1 || + resp.error_index > (int32_t)resp.nbindings || + snmp_object_seterror(snmptoolctx, &(resp.bindings[resp.error_index - 1]), resp.error_status) <= 0) { snmp_pdu_free(&resp); diff --git a/usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c b/usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c index d8fbb55290a8..4c53555407de 100644 --- a/usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c +++ b/usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c @@ -1993,7 +1993,8 @@ snmp_output_err_resp(struct snmp_toolinfo *snmptoolctx, struct snmp_pdu *pdu) struct snmp_object *object; char buf[ASN_OIDSTRLEN]; - if (pdu == NULL || (pdu->error_index > (int32_t) pdu->nbindings)) { + if (pdu == NULL || pdu->error_index < 1 || + (pdu->error_index > (int32_t) pdu->nbindings)) { fprintf(stdout, "Invalid error index in PDU\n"); return; }