CVS log for src/sys/external/bsd/libnv/dist/nvpair.c

Up to [cvs.NetBSD.org] / src / sys / external / bsd / libnv / dist

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

Pull up following revision(s) (requested by riastradh in ticket #1885):

	sys/external/bsd/libnv/dist/nvpair.c: revision 1.13

libnv: Check for NUL within bounds when unpacking string arrays.

This avoids buffer overrun in the subsequent nv_strdup, which can be
triggered by root at securelevel 1 via ioctl(IOC_NPF_*) on /dev/npf.

Matches upstream FreeBSD change by Mariusz Zaborski.

CVE-2024-45288

PR security/58652: libnv: Integer overflow and buffer overrun
vulnerabilities

Pull up following revision(s) (requested by riastradh in ticket #820):

	sys/external/bsd/libnv/dist/nvpair.c: revision 1.13

libnv: Check for NUL within bounds when unpacking string arrays.

This avoids buffer overrun in the subsequent nv_strdup, which can be
triggered by root at securelevel 1 via ioctl(IOC_NPF_*) on /dev/npf.

Matches upstream FreeBSD change by Mariusz Zaborski.

CVE-2024-45288

PR security/58652: libnv: Integer overflow and buffer overrun
vulnerabilities

libnv: Check for NUL within bounds when unpacking string arrays.

This avoids buffer overrun in the subsequent nv_strdup, which can be
triggered by root at securelevel 1 via ioctl(IOC_NPF_*) on /dev/npf.

Matches upstream FreeBSD change by Mariusz Zaborski
<oshogbo@FreeBSD.org>.

CVE-2024-45288

PR security/58652: libnv: Integer overflow and buffer overrun
vulnerabilities

libnv: Avoid arithmetic overflow in array allocation.

1. Teach nv_calloc and nv_strdup to detect arithmetic overflow.
2. Convert nv_malloc(sizeof(...) * N) to nv_calloc(N, sizeof(...)).

I reviewed all the remaining nv_malloc calls, because some of them
have the multiplication separated from the nv_malloc call.  Of the
remaining callers:

- nv_calloc (now) checks for overflow
- nv_strdup (now) checks for overflow
- nvlist_create uses a fixed sizeof(...) without arithmetic
- nvlist_xpack doesn't directly check bounds, but as long as the wire
  format is smaller than the in-memory size, that's not a problem
- nvlist_recv checks for sizeof(nvlhdr) + nvlhdr.nvlh_size overflow
- nvpair_unpack_binary uses nvp->nvp_datasize without arithmetic
- nvpair_unpack_bool_array checks for unsigned overflow
- nvpair_unpack_number_array checks for unsigned overflow
- nvpair_unpack_descriptor_array checks for unsigned overflow
- nvpair_create_binary uses caller-supplied size without arithmetic

Matches upstream FreeBSD change by Mariusz Zaborski
<oshogbo@FreeBSD.org>.

CVE-2024-45287

PR security/58652: libnv: Integer overflow and buffer overrun
vulnerabilities

Mostly merge changes from HEAD upto 20200411

Adapt for userland compilation

off by 1

need sys/kmem.h for kmem_free()

PR kern/54406: the result of vasprintf (in the kernel) should be freed
by kmem_free(). Spotted by Mindaugas.

- nvpair_create_stringf: use the in-kernel vasprintf().
- Make nvlist_add_stringf() availabe in the kernel.

Sync with HEAD

file nvpair.c was added on branch phil-wifi on 2019-06-10 22:08:38 +0000

nvpair_remove_nvlist_array: revert part of the rev 1.4 change (it was applied
by mistake because the libnv upsteam code on Github has deviated from FreeBSD,
i.e. it has a different nvlist_set_array_next() logic).

libnv: Free the data array for NV_TYPE_DESCRIPTOR_ARRAY case.
Obtained from FreeBSD rev 343987 by oshogbo@.

libnv: fix multiple memory leaks.

- nvpair_create_stringv: free the temporary string; this fix affects
  nvlist_add_stringf() and nvlist_add_stringv().

- nvpair_remove_nvlist_array (NV_TYPE_NVLIST_ARRAY case): free the chain
  of nvpairs (as resetting it prevents nvlist_destroy() from freeing it).
  Note: freeing the chain in nvlist_destroy() is not sufficient, because
  it would still leak through nvlist_take_nvlist_array().  This affects
  all nvlist_*_nvlist_array() users.

Found by clang/gcc ASAN.  These fixes have been contributed to the
upstream (FreeBSD) repository.

Ssync with HEAD

file nvpair.c was added on branch pgoyette-compat on 2018-09-30 01:45:55 +0000

fix kernel build.

Add NetBSD stuff.

Import libnv from FreeBSD

Initial revision