From nobody Thu Aug 6 15:01:34 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hG9Tq1p7qz6nBJH for ; Thu, 06 Aug 2026 15:01:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hG9Tp6XPGz3DtK for ; Thu, 06 Aug 2026 15:01:34 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786028494; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eZtKDJDDXUJBpxeY2cSODkTD3txgp11uR4Lx6fYW6H0=; b=cIG8sPQ9OImEZDRGZuabGMrhdE2SwVnXJtUGp0N2ipOQsCKFI0EP9FLtN2he/+sh0ncBUE p7fV23SvPYhYX8IYI+wk0DEEJNT3kwC++eNbOaWWq7sAdi3bNrzHbeCQuZoe/+mKgYLXni d2XnnM+nleh/TRRXwkbnFR024MoAcsSZIrVIyuu2hAk9sf7aM946chNfGRcb1NVcb0B32g oFGZkXk8NSHXmKvNOzEUYs0M31liqTAl23oKDUtuyB3H6uLtMkBFHdyo9QUIV3Ws3L1tlq 0S+BoQGJN/NS3KN7kg4UFuA7WC2OfC25K/tgwiWzxtHZ/rOx5BAzASvUHohzHw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1786028494; a=rsa-sha256; cv=none; b=BoDpcVujQHyfeJZtR9w5cA1McRp2BwrmwVVobx6n53VM4QJp64PIuGtv7o9XTacADM5s1e G23YS2IA1aPPGjCU4tMeeLnydurrjkaIv5BdftJKrWsNlfgjLAz9JyiFsTj9KRVVMFpiVr 7YqMRoVCFvx31ZfTNuBGO+st+N/AbwGLtHfBXCEJHrcKVpRvhZdrh6MxdQW/IXSf7dnXtQ X0nDUvWTP/xKX3N/2nCY9jaHxs52P5X6tDhEwjt4Eu9mZzRYfw92HahjiP9RRTWakzJQ+l dSytOJC9QcI9fG95YRygtJrC7ecz8JNHsy26HbLIgE8j3K6OOmM8a/maiv884w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786028494; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eZtKDJDDXUJBpxeY2cSODkTD3txgp11uR4Lx6fYW6H0=; b=Ryp+kZn/l6T5YGfmiGOmXOI44OLNMxvdB3eiY/RbTwrZd4lQS9dNSsSDz8fqtwk0/kmB8G 4x4eJhBpQ8M7T5MXeKDUgTA8IhDppBWfAPTEH9dfwpObEIUEufv73GmbvBSfu5o0gRJxBj 5eVUEy7pA8x7ZzHGsyJJRapuvPj2YwkPfRxBeeo6Fcmk5ileffocVv3xwArUPuHEoSS4W9 HWCV1sR57YP5M63Zyrf7Cdmi51VBIJlWj8crJOgB2q3cWxGOcaXqOhkDqHb4FwKoscrOjw /F6GmBJ0HbJoMU0cxwcgLpIPnMBtZw1GwpsR5bmIbNmyK1QNiUO984Sq6rschA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hG9Tp4TcGz9Gv for ; Thu, 06 Aug 2026 15:01:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45c3c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 06 Aug 2026 15:01:34 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 3101f4127344 - stable/15 - rpcinfo: Fix buffer overflows List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 3101f41273440ba869626b472ae84b14fc4dc7a9 Auto-Submitted: auto-generated Date: Thu, 06 Aug 2026 15:01:34 +0000 Message-Id: <6a74a1ce.45c3c.4fdde64f@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=3101f41273440ba869626b472ae84b14fc4dc7a9 commit 3101f41273440ba869626b472ae84b14fc4dc7a9 Author: Mark Johnston AuthorDate: 2026-07-27 18:59:08 +0000 Commit: Mark Johnston CommitDate: 2026-08-06 12:52:28 +0000 rpcinfo: Fix buffer overflows Several functions were using sprintf() to write RPC server-controlled data to a stack buffer. Adopt some minimal changes from NetBSD to avoid the potential overflows. Security: CVE-2026-16277 Security: CVE-2026-16461 Reviewed by: khorben MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58441 (cherry picked from commit 152ba2d3c5ff00382260a48653855072d524cfb8) --- usr.bin/rpcinfo/rpcinfo.c | 117 ++++++++++++++++++++++++++-------------------- 1 file changed, 67 insertions(+), 50 deletions(-) diff --git a/usr.bin/rpcinfo/rpcinfo.c b/usr.bin/rpcinfo/rpcinfo.c index 5f2dd4433292..1d7354ae3722 100644 --- a/usr.bin/rpcinfo/rpcinfo.c +++ b/usr.bin/rpcinfo/rpcinfo.c @@ -758,24 +758,22 @@ rpcbdump(int dumptype, char *netid, int argc, char **argv) list->rpcb_map.r_prog = pmaphead->pml_map.pm_prog; list->rpcb_map.r_vers = pmaphead->pml_map.pm_vers; if (pmaphead->pml_map.pm_prot == IPPROTO_UDP) - list->rpcb_map.r_netid = "udp"; + list->rpcb_map.r_netid = strdup("udp"); else if (pmaphead->pml_map.pm_prot == IPPROTO_TCP) - list->rpcb_map.r_netid = "tcp"; + list->rpcb_map.r_netid = strdup("tcp"); else { -#define MAXLONG_AS_STRING "2147483648" - list->rpcb_map.r_netid = - malloc(strlen(MAXLONG_AS_STRING) + 1); - if (list->rpcb_map.r_netid == NULL) - goto error; - sprintf(list->rpcb_map.r_netid, "%6ld", - pmaphead->pml_map.pm_prot); + (void)asprintf(&list->rpcb_map.r_netid, "%6ld", + pmaphead->pml_map.pm_prot); } + if (list->rpcb_map.r_netid == NULL) + goto error; list->rpcb_map.r_owner = UNKNOWN; low = pmaphead->pml_map.pm_port & 0xff; high = (pmaphead->pml_map.pm_port >> 8) & 0xff; - list->rpcb_map.r_addr = strdup("0.0.0.0.XXX.XXX"); - sprintf(&list->rpcb_map.r_addr[8], "%d.%d", - high, low); + (void)asprintf(&list->rpcb_map.r_addr, + "0.0.0.0.%d.%d", high, low); + if (list->rpcb_map.r_addr == NULL) + goto error; prev = list; } } @@ -838,10 +836,11 @@ failed: printf("%10ld ", rs->prog); for (vl = rs->vlist; vl; vl = vl->next) { - sprintf(p, "%d", vl->vers); + if ((size_t)(p - buf) >= sizeof(buf)) + break; + (void)snprintf(p, sizeof(buf) - (p - buf), + "%d%s", vl->vers, vl->next ? "," : ""); p = p + strlen(p); - if (vl->next) - sprintf(p++, ","); } printf("%-10s", buf); buf[0] = '\0'; @@ -947,11 +946,11 @@ rpcbaddrlist(char *netid, int argc, char **argv) re = &head->rpcb_entry_map; printf("%10u%3u ", parms.r_prog, parms.r_vers); - sprintf(buf, "%s/%s/%s ", - re->r_nc_protofmly, re->r_nc_proto, - re->r_nc_semantics == NC_TPI_CLTS ? "clts" : - re->r_nc_semantics == NC_TPI_COTS ? "cots" : - "cots_ord"); + (void)snprintf(buf, sizeof(buf), "%s/%s/%s ", + re->r_nc_protofmly, re->r_nc_proto, + re->r_nc_semantics == NC_TPI_CLTS ? "clts" : + re->r_nc_semantics == NC_TPI_COTS ? "cots" : + "cots_ord"); printf("%-24s", buf); printf("%-24s", re->r_maddr); rpc = getrpcbynumber(parms.r_prog); @@ -1024,37 +1023,41 @@ rpcbgetstat(int argc, char **argv) fieldbuf[0] = '\0'; switch (i) { case PMAPPROC_SET: - sprintf(fieldbuf, "%d/", inf[RPCBVERS_2_STAT].setinfo); + (void)snprintf(fieldbuf, sizeof(fieldbuf), "%d/", + inf[RPCBVERS_2_STAT].setinfo); break; case PMAPPROC_UNSET: - sprintf(fieldbuf, "%d/", - inf[RPCBVERS_2_STAT].unsetinfo); + (void)snprintf(fieldbuf, sizeof(fieldbuf), "%d/", + inf[RPCBVERS_2_STAT].unsetinfo); break; case PMAPPROC_GETPORT: cnt = 0; for (pa = inf[RPCBVERS_2_STAT].addrinfo; pa; pa = pa->next) cnt += pa->success; - sprintf(fieldbuf, "%d/", cnt); + (void)snprintf(fieldbuf, sizeof(fieldbuf), "%d/", cnt); break; case PMAPPROC_CALLIT: cnt = 0; for (pr = inf[RPCBVERS_2_STAT].rmtinfo; pr; pr = pr->next) cnt += pr->success; - sprintf(fieldbuf, "%d/", cnt); + (void)snprintf(fieldbuf, sizeof(fieldbuf), "%d/", cnt); break; default: break; /* For the remaining ones */ } cp = &fieldbuf[0] + strlen(fieldbuf); - sprintf(cp, "%d", inf[RPCBVERS_2_STAT].info[i]); + (void)snprintf(cp, sizeof(fieldbuf) - (cp - fieldbuf), "%d", + inf[RPCBVERS_2_STAT].info[i]); flen = strlen(fieldbuf); printf("%s%s", pmaphdr[i], spaces((TABSTOP * (1 + flen / TABSTOP)) - strlen(pmaphdr[i]))); - sprintf(lp, "%s%s", fieldbuf, - spaces(cnt = ((TABSTOP * (1 + flen / TABSTOP)) - - flen))); + if ((size_t)(lp - linebuf) >= sizeof(linebuf)) + break; + (void)snprintf(lp, sizeof(linebuf) - (lp - linebuf), "%s%s", + fieldbuf, spaces(cnt = ((TABSTOP * (1 + flen / TABSTOP)) - + flen))); lp += (flen + cnt); } printf("\n%s\n\n", linebuf); @@ -1077,37 +1080,41 @@ rpcbgetstat(int argc, char **argv) fieldbuf[0] = '\0'; switch (i) { case RPCBPROC_SET: - sprintf(fieldbuf, "%d/", inf[RPCBVERS_3_STAT].setinfo); + (void)snprintf(fieldbuf, sizeof(fieldbuf), "%d/", + inf[RPCBVERS_3_STAT].setinfo); break; case RPCBPROC_UNSET: - sprintf(fieldbuf, "%d/", - inf[RPCBVERS_3_STAT].unsetinfo); + (void)snprintf(fieldbuf, sizeof(fieldbuf), "%d/", + inf[RPCBVERS_3_STAT].unsetinfo); break; case RPCBPROC_GETADDR: cnt = 0; for (pa = inf[RPCBVERS_3_STAT].addrinfo; pa; pa = pa->next) cnt += pa->success; - sprintf(fieldbuf, "%d/", cnt); + (void)snprintf(fieldbuf, sizeof(fieldbuf), "%d/", cnt); break; case RPCBPROC_CALLIT: cnt = 0; for (pr = inf[RPCBVERS_3_STAT].rmtinfo; pr; pr = pr->next) cnt += pr->success; - sprintf(fieldbuf, "%d/", cnt); + (void)snprintf(fieldbuf, sizeof(fieldbuf), "%d/", cnt); break; default: break; /* For the remaining ones */ } cp = &fieldbuf[0] + strlen(fieldbuf); - sprintf(cp, "%d", inf[RPCBVERS_3_STAT].info[i]); + (void)snprintf(cp, sizeof(fieldbuf) - (cp - fieldbuf), + "%d", inf[RPCBVERS_3_STAT].info[i]); flen = strlen(fieldbuf); printf("%s%s", rpcb3hdr[i], spaces((TABSTOP * (1 + flen / TABSTOP)) - strlen(rpcb3hdr[i]))); - sprintf(lp, "%s%s", fieldbuf, - spaces(cnt = ((TABSTOP * (1 + flen / TABSTOP)) - - flen))); + if ((size_t)(lp - linebuf) >= sizeof(linebuf)) + break; + (void)snprintf(lp, sizeof(linebuf) - (lp - linebuf), "%s%s", + fieldbuf, spaces(cnt = ((TABSTOP * (1 + flen / TABSTOP)) - + flen))); lp += (flen + cnt); } printf("\n%s\n\n", linebuf); @@ -1132,26 +1139,28 @@ rpcbgetstat(int argc, char **argv) fieldbuf[0] = '\0'; switch (i) { case RPCBPROC_SET: - sprintf(fieldbuf, "%d/", - inf[RPCBVERS_4_STAT].setinfo); + (void)snprintf(fieldbuf, sizeof(fieldbuf), + "%d/", inf[RPCBVERS_4_STAT].setinfo); break; case RPCBPROC_UNSET: - sprintf(fieldbuf, "%d/", - inf[RPCBVERS_4_STAT].unsetinfo); + (void)snprintf(fieldbuf, sizeof(fieldbuf), + "%d/", inf[RPCBVERS_4_STAT].unsetinfo); break; case RPCBPROC_GETADDR: cnt = 0; for (pa = inf[RPCBVERS_4_STAT].addrinfo; pa; pa = pa->next) cnt += pa->success; - sprintf(fieldbuf, "%d/", cnt); + (void)snprintf(fieldbuf, sizeof(fieldbuf), + "%d/", cnt); break; case RPCBPROC_CALLIT: cnt = 0; for (pr = inf[RPCBVERS_4_STAT].rmtinfo; pr; pr = pr->next) cnt += pr->success; - sprintf(fieldbuf, "%d/", cnt); + (void)snprintf(fieldbuf, sizeof(fieldbuf), + "%d/", cnt); break; default: break; /* For the remaining ones */ } @@ -1162,17 +1171,25 @@ rpcbgetstat(int argc, char **argv) * RPCB_GETADDRLIST successes in RPCB_GETADDR. */ if (i != RPCBPROC_GETADDR) - sprintf(cp, "%d", inf[RPCBVERS_4_STAT].info[i]); + (void)snprintf(cp, + sizeof(fieldbuf) - (cp - fieldbuf), + "%d", inf[RPCBVERS_4_STAT].info[i]); else - sprintf(cp, "%d", inf[RPCBVERS_4_STAT].info[i] + - inf[RPCBVERS_4_STAT].info[RPCBPROC_GETADDRLIST]); + (void)snprintf(cp, + sizeof(fieldbuf) - (cp - fieldbuf), + "%d", inf[RPCBVERS_4_STAT].info[i] + + inf[RPCBVERS_4_STAT]. + info[RPCBPROC_GETADDRLIST]); flen = strlen(fieldbuf); printf("%s%s", rpcb4hdr[i], spaces((TABSTOP * (1 + flen / TABSTOP)) - strlen(rpcb4hdr[i]))); - sprintf(lp, "%s%s", fieldbuf, - spaces(cnt = ((TABSTOP * (1 + flen / TABSTOP)) - - flen))); + if ((size_t)(lp - linebuf) >= sizeof(linebuf)) + break; + (void)snprintf(lp, sizeof(linebuf) - (lp - linebuf), + "%s%s", fieldbuf, + spaces(cnt = ((TABSTOP * (1 + flen / TABSTOP)) - + flen))); lp += (flen + cnt); } printf("\n%s\n", linebuf);