Mariusz Zaborski 4f0992ce23 libnv: fix heap overflow in nvlist_recv() ...

nvlist_check_header() validated nvlh_size for overflow before
performing conversion. An mallicous user can set
NV_FLAG_BIG_ENDIAN in the header and craft nvlh_size so that
the orginall value passes the check, but after the conversion the
sizeof(nvlist_header) + size can overflow.
This can lead to a heap buffer overflow.

Approved by:	so
Security:	FreeBSD-SA-26:17.libnv
Security:	CVE-2026-35547
Fixes:		36fa90dbde
Reviewed by:	markj
Differential Revision:	https://reviews.freebsd.org/D56342

2026-04-28 20:33:58 +00:00

..

tests

libnv: fix heap overflow in nvlist_recv()

2026-04-28 20:33:58 +00:00

common_impl.h

Remove "All Rights Reserved" from FreeBSD Foundation copyrights

2024-08-06 15:39:53 -04:00

Makefile

Remove $FreeBSD$: one-line sh pattern

2023-08-16 11:55:03 -06:00

Makefile.depend

Remove $FreeBSD$: one-line sh pattern

2023-08-16 11:55:03 -06:00

msgio.c

libnv: switch fd_wait() from select(2) to poll(2)

2026-04-28 20:33:58 +00:00

msgio.h

Remove $FreeBSD$: two-line .h pattern

2023-08-16 11:54:16 -06:00

Version.map

Remove $FreeBSD$: one-line sh pattern

2023-08-16 11:55:03 -06:00