Mariusz Zaborski e2219bbd63 libnv: fix heap overflow in nvlist_recv() ...

nvlist_check_header() validated nvlh_size for overflow before
performing conversion. An mallicous user can set
NV_FLAG_BIG_ENDIAN in the header and craft nvlh_size so that
the orginall value passes the check, but after the conversion the
sizeof(nvlist_header) + size can overflow.
This can lead to a heap buffer overflow.

Approved by:	so
Security:	FreeBSD-SA-26:17.libnv
Security:	CVE-2026-35547
Fixes:		36fa90dbde
Reviewed by:	markj
Differential Revision:	https://reviews.freebsd.org/D56342

2026-04-29 14:39:28 +00:00

..

tests

libnv: fix heap overflow in nvlist_recv()

2026-04-29 14:39:28 +00:00

common_impl.h

…

Makefile

…

Makefile.depend

…

msgio.c

libnv: switch fd_wait() from select(2) to poll(2)

2026-04-29 14:39:28 +00:00

msgio.h

…

Version.map

…