branches: 1.1.2; 1.1.6;
Add config glue

branches: 1.2.2; 1.2.6;
Add NetBSD stuff.

branches: 1.1.1;
Initial revision

branches: 1.2.2; 1.2.6;
Add NetBSD stuff.

branches: 1.1.1;
Initial revision

branches: 1.2.2; 1.2.6;
Add NetBSD stuff.

branches: 1.1.1;
Initial revision

branches: 1.2.2; 1.2.6;
Add NetBSD stuff.

branches: 1.1.1;
Initial revision

branches: 1.2.2; 1.2.6;
Add NetBSD stuff.

branches: 1.1.1;
Initial revision

branches: 1.2.2; 1.2.6;
Add NetBSD stuff.

branches: 1.1.1;
Initial revision

branches: 1.4.2; 1.4.6;
fix kernel build.

FIx userland build

Add NetBSD stuff.

branches: 1.1.1;
Initial revision

branches: 1.2.2; 1.2.6;
Add NetBSD stuff.

branches: 1.1.1;
Initial revision

branches: 1.2.2; 1.2.6;
Add NetBSD stuff.

branches: 1.1.1;
Initial revision

branches: 1.2.2; 1.2.6;
Add NetBSD stuff.

branches: 1.1.1;
Initial revision

- nvpair_create_stringf: use the in-kernel vasprintf().
- Make nvlist_add_stringf() availabe in the kernel.

branches: 1.2.2; 1.2.6;
Add NetBSD stuff.

branches: 1.1.1;
Initial revision

branches: 1.1.2; 1.1.6;
Add NetBSD stuff.

Adapt for userland compilation

branches: 1.6.4;
libnv: fix multiple memory leaks.

- nvpair_create_stringv: free the temporary string; this fix affects
nvlist_add_stringf() and nvlist_add_stringv().

- nvpair_remove_nvlist_array (NV_TYPE_NVLIST_ARRAY case): free the chain
of nvpairs (as resetting it prevents nvlist_destroy() from freeing it).
Note: freeing the chain in nvlist_destroy() is not sufficient, because
it would still leak through nvlist_take_nvlist_array(). This affects
all nvlist_*_nvlist_array() users.

Found by clang/gcc ASAN. These fixes have been contributed to the
upstream (FreeBSD) repository.

branches: 1.5.2;
libnv: add a wrapper around free(9) since in FreeBSD it can take NULL.

libnv: fix some NetBSD wrappers.

FIx userland build

Add NetBSD stuff.

branches: 1.1.1;
Initial revision

libnv: Avoid arithmetic overflow in array allocation.

1. Teach nv_calloc and nv_strdup to detect arithmetic overflow.
2. Convert nv_malloc(sizeof(...) * N) to nv_calloc(N, sizeof(...)).

I reviewed all the remaining nv_malloc calls, because some of them
have the multiplication separated from the nv_malloc call. Of the
remaining callers:

- nv_calloc (now) checks for overflow
- nv_strdup (now) checks for overflow
- nvlist_create uses a fixed sizeof(...) without arithmetic
- nvlist_xpack doesn't directly check bounds, but as long as the wire
format is smaller than the in-memory size, that's not a problem
- nvlist_recv checks for sizeof(nvlhdr) + nvlhdr.nvlh_size overflow
- nvpair_unpack_binary uses nvp->nvp_datasize without arithmetic
- nvpair_unpack_bool_array checks for unsigned overflow
- nvpair_unpack_number_array checks for unsigned overflow
- nvpair_unpack_descriptor_array checks for unsigned overflow
- nvpair_create_binary uses caller-supplied size without arithmetic

Matches upstream FreeBSD change by Mariusz Zaborski
<oshogbo@FreeBSD.org>.

CVE-2024-45287

PR security/58652: libnv: Integer overflow and buffer overrun
vulnerabilities

branches: 1.6.4; 1.6.38;
fix the shit, as usual

branches: 1.5.2;
nvlist_copyin: fix the flag handling.

libnv: add a wrapper around free(9) since in FreeBSD it can take NULL.

libnv: fix some NetBSD wrappers.

FIx userland build

Add NetBSD stuff.

libnv: Fix pointer/struct confusion in bounds check.

No impact to NetBSD because the path where this bounds check matters
is not used in NetBSD.

Matches upstream FreeBSD change by Mariusz Zaborski
<oshogbo@FreeBSD.org>.

CVE-2024-45287

PR security/58652: libnv: Integer overflow and buffer overrun
vulnerabilities

libnv: Avoid arithmetic overflow in array allocation.

1. Teach nv_calloc and nv_strdup to detect arithmetic overflow.
2. Convert nv_malloc(sizeof(...) * N) to nv_calloc(N, sizeof(...)).

I reviewed all the remaining nv_malloc calls, because some of them
have the multiplication separated from the nv_malloc call. Of the
remaining callers:

- nv_calloc (now) checks for overflow
- nv_strdup (now) checks for overflow
- nvlist_create uses a fixed sizeof(...) without arithmetic
- nvlist_xpack doesn't directly check bounds, but as long as the wire
format is smaller than the in-memory size, that's not a problem
- nvlist_recv checks for sizeof(nvlhdr) + nvlhdr.nvlh_size overflow
- nvpair_unpack_binary uses nvp->nvp_datasize without arithmetic
- nvpair_unpack_bool_array checks for unsigned overflow
- nvpair_unpack_number_array checks for unsigned overflow
- nvpair_unpack_descriptor_array checks for unsigned overflow
- nvpair_create_binary uses caller-supplied size without arithmetic

Matches upstream FreeBSD change by Mariusz Zaborski
<oshogbo@FreeBSD.org>.

CVE-2024-45287

PR security/58652: libnv: Integer overflow and buffer overrun
vulnerabilities

libnv: Refuse nonsensically large header size in nvlist_check_header.

This avoids potential integer overflow in nvlist_recv, which is not
used in NetBSD. The only other user of nvlist_check_header is
nvlist_unpack_header, which verifies the header sizes matches the
framing and so is not affected by integer overflow.

Matches upstream FreeBSD change by Mariusz Zaborski
<oshogbo@FreeBSD.org>.

CVE-2024-45287

PR security/58652: libnv: Integer overflow and buffer overrun
vulnerabilities

branches: 1.8.34;
- nvpair_create_stringf: use the in-kernel vasprintf().
- Make nvlist_add_stringf() availabe in the kernel.

branches: 1.7.4;
libnv: fix multiple memory leaks.

- nvpair_create_stringv: free the temporary string; this fix affects
nvlist_add_stringf() and nvlist_add_stringv().

- nvpair_remove_nvlist_array (NV_TYPE_NVLIST_ARRAY case): free the chain
of nvpairs (as resetting it prevents nvlist_destroy() from freeing it).
Note: freeing the chain in nvlist_destroy() is not sufficient, because
it would still leak through nvlist_take_nvlist_array(). This affects
all nvlist_*_nvlist_array() users.

Found by clang/gcc ASAN. These fixes have been contributed to the
upstream (FreeBSD) repository.

branches: 1.6.2;
libnv: fix some NetBSD wrappers.

add dead...

fix kernel build.

FIx userland build

Add NetBSD stuff.

branches: 1.1.1;
Initial revision

branches: 1.3.2; 1.3.6;
add dead...

Add NetBSD stuff.

branches: 1.1.1;
Initial revision

libnv: Check for NUL within bounds when unpacking string arrays.

This avoids buffer overrun in the subsequent nv_strdup, which can be
triggered by root at securelevel 1 via ioctl(IOC_NPF_*) on /dev/npf.

Matches upstream FreeBSD change by Mariusz Zaborski
<oshogbo@FreeBSD.org>.

CVE-2024-45288

PR security/58652: libnv: Integer overflow and buffer overrun
vulnerabilities

libnv: Avoid arithmetic overflow in array allocation.

1. Teach nv_calloc and nv_strdup to detect arithmetic overflow.
2. Convert nv_malloc(sizeof(...) * N) to nv_calloc(N, sizeof(...)).

I reviewed all the remaining nv_malloc calls, because some of them
have the multiplication separated from the nv_malloc call. Of the
remaining callers:

- nv_calloc (now) checks for overflow
- nv_strdup (now) checks for overflow
- nvlist_create uses a fixed sizeof(...) without arithmetic
- nvlist_xpack doesn't directly check bounds, but as long as the wire
format is smaller than the in-memory size, that's not a problem
- nvlist_recv checks for sizeof(nvlhdr) + nvlhdr.nvlh_size overflow
- nvpair_unpack_binary uses nvp->nvp_datasize without arithmetic
- nvpair_unpack_bool_array checks for unsigned overflow
- nvpair_unpack_number_array checks for unsigned overflow
- nvpair_unpack_descriptor_array checks for unsigned overflow
- nvpair_create_binary uses caller-supplied size without arithmetic

Matches upstream FreeBSD change by Mariusz Zaborski
<oshogbo@FreeBSD.org>.

CVE-2024-45287

PR security/58652: libnv: Integer overflow and buffer overrun
vulnerabilities

branches: 1.11.2; 1.11.28; 1.11.34;
Adapt for userland compilation

off by 1

need sys/kmem.h for kmem_free()

PR kern/54406: the result of vasprintf (in the kernel) should be freed
by kmem_free(). Spotted by Mindaugas.

- nvpair_create_stringf: use the in-kernel vasprintf().
- Make nvlist_add_stringf() availabe in the kernel.

branches: 1.6.4;
nvpair_remove_nvlist_array: revert part of the rev 1.4 change (it was applied
by mistake because the libnv upsteam code on Github has deviated from FreeBSD,
i.e. it has a different nvlist_set_array_next() logic).

libnv: Free the data array for NV_TYPE_DESCRIPTOR_ARRAY case.
Obtained from FreeBSD rev 343987 by oshogbo@.

libnv: fix multiple memory leaks.

- nvpair_create_stringv: free the temporary string; this fix affects
nvlist_add_stringf() and nvlist_add_stringv().

- nvpair_remove_nvlist_array (NV_TYPE_NVLIST_ARRAY case): free the chain
of nvpairs (as resetting it prevents nvlist_destroy() from freeing it).
Note: freeing the chain in nvlist_destroy() is not sufficient, because
it would still leak through nvlist_take_nvlist_array(). This affects
all nvlist_*_nvlist_array() users.

Found by clang/gcc ASAN. These fixes have been contributed to the
upstream (FreeBSD) repository.

branches: 1.3.2;
fix kernel build.

Add NetBSD stuff.

branches: 1.1.1;
Initial revision

branches: 1.2.2; 1.2.6;
Add NetBSD stuff.

branches: 1.1.1;
Initial revision