[Bug 265385] lib9p's l9p_puqids() can write beyond the end of qids[]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=265385

--- Comment #4 from commit-hook@FreeBSD.org ---
A commit in branch main references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=2dd83b3f0507fc7bc64b908fb88f285a3b9663c8

commit 2dd83b3f0507fc7bc64b908fb88f285a3b9663c8
Author:     Konrad Sewiłło-Jopek <kjopek@gmail.com>
AuthorDate: 2022-08-08 16:25:48 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2022-08-08 16:50:43 +0000

    lib9p: Remove potential buffer overwrite in l9p_puqids()

    Structure l9p_f_wralk reserves at most L9P_MAX_WELEM entries
    and that number actually set the maximum we can safely use.

    PR:             265385
    Reviewed by:    markj
    MFC after:      1 day
    Differential Revision:  https://reviews.freebsd.org/D35907

 contrib/lib9p/pack.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

-- 
You are receiving this mail because:
You are the assignee for the bug.