HomeFreeBSD

libnv: verify that string is null terminated

Description

libnv: verify that string is null terminated

During unpacking, we ensure that we do not read beyond the
declared size. However, unpack uses a function that copies
null-terminated strings. Prior to this commit, if the last string
was not null-terminated, it could result in copying data into a
buffer smaller than the allocated size.

Security: FreeBSD-24:09.libnv
Security: CVE-2024-45288
Security: CAP-03
Reported by: Synacktiv
Sponsored by: The Alpha-Omega Project
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D46138

(cherry picked from commit 3aaaca1b51ad844ef9e9b3d945217ab3dd189bae)
(cherry picked from commit 9c2ef102166eaab4c2531eb0ce6ffb20b82e778a)

Approved by: so

Details

Provenance
oshogboAuthored on Aug 26 2024, 6:20 PM
emasteCommitted on Sep 4 2024, 8:48 PM
Differential Revision
Restricted Differential Revision
Parents
rG69d50af527c0: libnv: allocate buffer in a safe way
Branches
Unknown
Tags
Unknown