Page MenuHomeFreeBSD

cap_dns, cap_net: fix host and service buffer handling
ClosedPublic

Authored by vangyzen on Mar 30 2023, 10:18 PM.
Tags
None
Referenced Files
Unknown Object (File)
Apr 20 2024, 3:24 PM
Unknown Object (File)
Dec 23 2023, 2:56 AM
Unknown Object (File)
Dec 11 2023, 11:23 PM
Unknown Object (File)
Jun 22 2023, 6:04 PM
Unknown Object (File)
May 7 2023, 3:28 AM
Unknown Object (File)
May 3 2023, 2:01 AM
Unknown Object (File)
Apr 6 2023, 2:55 AM
Unknown Object (File)
Apr 4 2023, 8:23 PM

Details

Summary

If a malicious casper process sent a host or service string that was
too long, cap_getnameinfo would overrun the caller's buffer by one byte.

The backends for this function needlessly allocated one extra byte
for these buffers. This was harmless, but could be confusing to readers.

Reported by: Coverity
MFC after: 1 week
Sponsored by: Dell EMC Isilon

Test Plan
$ kyua debug net_test:capnet__getnameinfo_overflow
net_test:capnet__getnameinfo_overflow  ->  passed

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

please add the CID to the commit message

(unless this is not from Coverity Scan's FreeBSD report)

This revision is now accepted and ready to land.Apr 4 2023, 6:18 PM

please add the CID to the commit message
(unless this is not from Coverity Scan's FreeBSD report)

It's from an internal run at Dell (Isilon). Oddly enough, I can't find this issue in the public FreeBSD report.

Thanks for the reviews, folks.