[Bug 298222] corrupt response packet can cause bsnmpwalk to write outside of array

Go to: [ bottom of page ] [ top of archives ] [ this month ]

From: <bugzilla-noreply_at_freebsd.org>
Date: Tue, 22 Sep 2026 21:50:21 UTC

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298222

--- Comment #5 from commit-hook@FreeBSD.org ---
A commit in branch main references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=296e3fd54ca8972fa6696974097a2f2705f8dfc4

commit 296e3fd54ca8972fa6696974097a2f2705f8dfc4
Author:     Maxim Konovalov <maxim@FreeBSD.org>
AuthorDate: 2026-09-22 21:32:43 +0000
Commit:     Maxim Konovalov <maxim@FreeBSD.org>
CommitDate: 2026-09-22 21:32:43 +0000

    bsnmp: validate the lower bound of error_index in responses

    Check if the response's error_index is within a sane interval.
    Otherwise, a rogue peer could crash us.

    PR:             298222
    Reported by:    Robert Morris
    Reviewed by:    markj
    Discussed with: secteam (markj)
    MFC after:      2 weeks
    Analyzed with:  Claude Code Opus 5

 usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c      | 8 ++++++--
 usr.sbin/bsnmpd/tools/libbsnmptools/bsnmptools.c | 3 ++-
 2 files changed, 8 insertions(+), 3 deletions(-)

-- 
You are receiving this mail because:
You are the assignee for the bug.