Faraz Vahedi 13bcc9a882
libc: Fix stack buffer overflow in cgetnext() ...
`cgetnext()` copies a capability record's name field into a fixed
1024 byte on-stack buffer (`nbuf[BSIZE]`) one character at a time,
but never checks that the write pointer stays within the buffer.
Therefore, a record name that is longer than `BSIZE` (either on a
single line, or accumulated across several `\`-continued lines as
the pointer is not reset amidst continuation) writes past the end
of `nbuf` and smashes the stack.
The name field is read directly from the capability file, so any
consumer of `cgetnext()`/`cgetfirst()` that processes an untrusted
`termcap(5)`- or `printcap(5)`-style database (e.g. `cap_mkdb(1)`,
`lpr(1)`, or any third-party caller) can be exposed and hence made
to corrupt the stack.
Reviewed by: fuz, dteske
Approved by: fuz (mentor), dteske (mentor)
MFC after: 1 week
Pull Request: https://github.com/freebsd/freebsd-src/pull/2309
2026-10-29 15:39:45 +03:30
2026-09-22 08:23:32 -07:00
2026-09-28 18:13:02 +02:00
2026-01-13 10:19:04 -05:00
2026-09-28 01:54:40 +08:00
2026-09-12 14:29:18 -04:00
2026-09-01 15:28:28 +00:00
2026-10-07 09:15:49 +08:00
2024-07-15 16:43:39 -06:00
2026-10-29 10:22:24 +01:00
2024-04-28 22:33:06 -06:00
2026-09-04 21:46:20 +02:00
2024-07-15 16:43:39 -06:00
2024-07-15 16:43:39 -06:00
2026-01-06 04:28:43 +00:00
2026-01-06 04:28:43 +00:00
2024-07-15 16:43:39 -06:00
2025-10-12 16:28:20 +01:00
2026-09-22 15:31:20 -07:00
2025-11-03 21:18:46 +01:00
2025-09-30 11:31:12 +08:00
2025-09-30 09:14:58 +01:00
2025-07-25 13:10:17 -07:00
2025-10-09 22:35:54 -07:00
2026-10-29 15:39:45 +03:30
2024-11-12 12:11:51 -05:00
2026-05-01 20:16:18 +02:00
2024-11-12 12:11:51 -05:00
2024-07-15 16:43:39 -06:00
2025-06-05 21:28:38 -04:00
2024-10-03 14:49:23 -03:00
2026-10-06 01:10:57 -07:00
2024-10-14 10:26:17 -07:00
2026-04-25 16:14:02 +02:00
2025-09-04 14:53:02 +01:00
2024-07-15 16:43:39 -06:00
2026-06-19 23:25:39 +02:00
2025-08-23 01:57:23 +01:00
2025-12-25 19:02:40 +01:00
2026-06-19 23:25:39 +02:00
2025-01-01 15:11:06 -06:00
2026-02-24 20:58:59 -05:00
2024-07-15 16:43:39 -06:00
2025-01-29 10:03:59 -05:00
2024-07-15 16:43:39 -06:00
2026-02-05 15:39:34 +01:00
2024-11-14 06:14:05 +02:00
2023-08-16 11:55:03 -06:00
2025-10-26 02:26:06 +00:00
2026-04-29 00:28:54 +03:30
2024-07-15 16:43:39 -06:00
2025-08-23 01:57:23 +01:00
2024-07-15 16:43:39 -06:00
2026-06-15 23:21:10 -04:00
2026-10-07 09:15:49 +08:00
2024-03-21 01:05:05 -04:00
2026-09-30 18:55:23 +02:00
2025-10-03 19:47:52 +02:00
2025-04-11 09:53:50 -04:00
2026-08-09 11:07:30 +02:00
2026-09-28 11:08:05 -04:00
2026-08-19 13:51:21 +03:30
2025-09-03 21:01:05 +03:00
2024-07-15 16:43:39 -06:00
2026-06-30 17:00:23 +00:00
2026-10-13 12:41:52 -04:00
2024-07-12 06:29:31 +03:00
2024-10-14 10:26:17 -07:00
2026-04-28 15:51:50 -05:00
2026-09-10 20:55:04 +01:00
2024-07-15 16:43:39 -06:00
2026-01-06 12:56:50 -05:00
2026-10-26 10:35:42 +00:00
2024-07-15 16:43:39 -06:00
2024-07-15 16:43:39 -06:00
2025-04-16 10:09:18 -04:00
2026-09-13 18:09:38 -07:00
2026-09-05 16:57:30 -07:00
2026-09-14 11:11:34 -04:00
2026-09-01 14:49:24 +02:00
2025-08-16 21:07:57 +01:00
2026-04-18 13:50:04 +02:00
2024-07-15 16:43:39 -06:00
2026-09-04 21:46:20 +02:00
2026-06-24 14:14:25 +00:00
2023-11-26 22:23:59 -07:00
2026-07-13 12:24:16 +00:00
2026-04-29 14:39:28 +00:00
2025-08-25 10:33:32 +02:00
2026-04-25 16:14:02 +02:00
2025-10-03 19:46:55 +02:00
2025-07-30 11:11:38 +01:00
2026-10-20 22:05:31 +00:00
2026-09-04 21:46:20 +02:00
2026-03-15 00:41:29 -03:00
2023-08-16 11:55:03 -06:00
2026-10-20 08:52:00 -04:00
2023-11-26 22:23:59 -07:00
2026-07-02 02:57:45 +02:00
2026-10-19 16:02:04 -04:00
2026-09-23 14:35:44 -04:00
2026-07-16 14:56:29 -07:00
2025-11-24 10:47:10 -05:00
2025-10-26 02:26:06 +00:00
2025-08-08 13:27:26 -05:00
2026-06-22 21:44:44 +00:00
2025-08-15 17:59:18 +01:00
2024-10-08 16:13:39 -03:00
2025-12-18 17:19:42 -05:00
2024-07-30 12:16:36 -04:00
2025-10-02 02:37:35 +01:00
2026-10-18 11:24:20 -07:00
2025-09-30 09:14:51 +01:00
2026-04-10 10:46:54 -07:00
2025-08-23 01:57:23 +01:00
2024-07-15 16:43:39 -06:00
2025-08-23 01:57:23 +01:00
2025-08-23 01:57:23 +01:00
2024-07-15 16:43:39 -06:00
2024-10-14 10:26:17 -07:00
2024-11-12 12:11:51 -05:00
2024-07-15 16:43:39 -06:00
2025-09-30 09:15:04 +01:00
2025-09-30 09:14:38 +01:00
2026-10-26 10:35:42 +00:00
2026-10-08 11:21:06 -04:00
2025-10-26 02:26:06 +00:00
2025-08-23 01:57:23 +01:00
2026-10-28 02:56:06 +02:00
2024-07-30 12:16:36 -04:00
2024-07-15 16:43:39 -06:00
2026-06-01 16:48:21 -07:00
2024-07-15 16:43:39 -06:00
2024-11-12 12:11:51 -05:00
2026-10-21 13:24:44 +00:00
2026-08-24 09:29:52 +08:00
2024-06-06 10:09:05 -04:00
2026-09-26 19:14:00 +03:00
2026-08-02 13:17:45 +02:00
2025-12-02 05:41:13 +02:00
2024-10-15 17:18:14 -03:00
2024-02-02 18:35:01 -07:00
2026-08-20 15:12:14 -07:00
2025-10-26 02:26:06 +00:00
2025-10-26 02:26:06 +00:00
2025-09-30 09:14:05 +01:00
2025-06-26 09:02:31 +02:00
2026-01-06 04:26:53 +00:00
2026-03-13 23:49:53 +00:00
2026-04-08 14:22:45 -07:00
2026-10-26 10:32:42 +00:00
2026-01-15 07:28:28 +01:00
2025-10-26 02:26:06 +00:00
2026-09-15 10:22:38 -04:00
2024-07-15 16:43:39 -06:00
2026-01-30 18:25:02 +02:00
2026-09-28 11:08:05 -04:00
2023-08-16 11:55:03 -06:00
Faraz Vahedi
13bcc9a882