Module Name: src
Committed By: riastradh
Date: Wed Sep 11 15:01:11 UTC 2024
Modified Files:
src/sys/external/bsd/libnv/dist: nvlist.c
Log Message:
libnv: Fix pointer/struct confusion in bounds check.
No impact to NetBSD because the path where this bounds check matters
is not used in NetBSD.
Matches upstream FreeBSD change by Mariusz Zaborski
<[email protected]>.
CVE-2024-45287
PR security/58652: libnv: Integer overflow and buffer overrun
vulnerabilities
To generate a diff of this commit:
cvs rdiff -u -r1.10 -r1.11 src/sys/external/bsd/libnv/dist/nvlist.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/external/bsd/libnv/dist/nvlist.c
diff -u src/sys/external/bsd/libnv/dist/nvlist.c:1.10 src/sys/external/bsd/libnv/dist/nvlist.c:1.11
--- src/sys/external/bsd/libnv/dist/nvlist.c:1.10 Wed Sep 4 12:57:00 2024
+++ src/sys/external/bsd/libnv/dist/nvlist.c Wed Sep 11 15:01:11 2024
@@ -1,4 +1,4 @@
-/* $NetBSD: nvlist.c,v 1.10 2024/09/04 12:57:00 riastradh Exp $ */
+/* $NetBSD: nvlist.c,v 1.11 2024/09/11 15:01:11 riastradh Exp $ */
/*-
* SPDX-License-Identifier: BSD-2-Clause-FreeBSD
@@ -36,7 +36,7 @@
#ifdef __FreeBSD__
__FBSDID("$FreeBSD: head/sys/contrib/libnv/nvlist.c 335347 2018-06-18 22:57:32Z oshogbo $");
#else
-__RCSID("$NetBSD: nvlist.c,v 1.10 2024/09/04 12:57:00 riastradh Exp $");
+__RCSID("$NetBSD: nvlist.c,v 1.11 2024/09/11 15:01:11 riastradh Exp $");
#endif
#include <sys/param.h>
@@ -1074,7 +1074,7 @@ static bool
nvlist_check_header(struct nvlist_header *nvlhdrp)
{
- if (nvlhdrp->nvlh_size > SIZE_MAX - sizeof(nvlhdrp)) {
+ if (nvlhdrp->nvlh_size > SIZE_MAX - sizeof(*nvlhdrp)) {
ERRNO_SET(EINVAL);
return (false);
}
