link_elf: bounds-check the DT_HASH offset
parse_dynamic() builds the symbol hash table at ef->address + d_ptr
without checking that d_ptr lies within the mapped image, so a crafted
DT_HASH entry causes an out-of-bounds read of the hash header. Reject
the object with ENOEXEC when the header does not fit in the image.
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61323
link_elf_obj: validate section name offsets
A section name offset (sh_name) indexes the section name string table
without being checked against shstrcnt, and the result is passed to
strcmp(), so a corrupt object causes an out-of-bounds read. Check that
the table is NUL-terminated and that every sh_name lies within it, in
both the preload and file paths, and reject the object with ENOEXEC.
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61338
link_elf_obj: validate symbol name offsets
A symbol name offset (st_name) indexes the string table in several
places without being checked against ddbstrcnt, so a corrupt object
causes an out-of-bounds read. Check that the string table is
NUL-terminated and that every st_name lies within it, in both the
preload and file paths, and reject the object with ENOEXEC.
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61322
link_elf_obj: bounds-check e_shstrndx in link_elf_load_file()
e_shstrndx is used to index the section header array after only being
checked against zero, so a malformed object can make the linker read up
to about 64K entries past the end of shdr[]. Reject such a file with
ENOEXEC, as link_elf_link_preload() already does.
Reported by: llm-postcr
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61321
ipfilter: Remove erroneous ntohs()
The original commit was wrong. ipf_nat_builddivertmp() builds the UDP
template with the length in host byte order
M_DUP() copies that value unchanged. The old code was therefore correct.
It added fin_plen in host order and then did a single htons().
The original patch was discussed with Co-Pilot, which pointed out the
original bug. claude-opus-5-5 discovered the ntohs() error that
co-pilot suggested.
Interestingly this code had been running here for a couple of months.
Reported by: llm-postcr
Fixes: 72cc9e3766f4
ipfilter: Only recalculate the UDP header when we have one
When ipf_nat_out processes NAT_DIVERTOUT (ipnat rdr statements)
it also fixes the checksum in the UDP header. Test for a UDP header
before adjusting its length.
While we are here, the length in the UDP header must be converted
from network byte order to host byte order. Add the missing ntohs().
PR: 296944
MFC after: 3 days
libcasper: Use pdfork() for the zygote
Use pdfork(2) rather than fork(2) to fork the zygote, and close the
descriptor when the main loop terminates.
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: Qualys, Inc.
Reviewed by: oshogbo
Differential Revision: https://reviews.freebsd.org/D60176
net/libpfctl: add 15.2, remove 15.0
15.0 is end-of-life, remove it from this port.
Add 15.2, which is in the process of being released.
Deliberately do not bump PORTVERSION, because we don't change existing
libpfctl versions, we only add a new supported FreeBSD version.
PR: 300134
Sponsored by: Rubicon Communications, LLC ("Netgate")
pf tests: make return.py more robust
Sometimes ICMP echo packets get lost, so send more than one during
the sanity check. This should resolve the intermittent failure of the
return.py:TestReturn::test_tcp test.
PR: 300511
Sponsored by: Rubicon Communications, LLC ("Netgate")
graphics/graphviz: remove duplicate lang/tcl BUILD_DEPENDS, again
When ${TCLTK_DEFAULT} != 8.6:
(graphics/graphviz): Error: graphics/graphviz depends on nonexistent
origin lang/tcl91; Please contact maintainer of the port to fix
this.
PR: 300092
intel/intel_pmc: Add support for Cannon Lake through Meteor Lake
Match the platform by CPU model and attach on acpi with PWRM at
0xfe000000; the PMC is not PCI-enumerable on these platforms.
SLP_S0_RES offsets and granularities follow each generation's PCH
Family Datasheet Volume 2. A mismatch between the LPIT residency
counter address and SLP_S0_RES is reported on attach.
Reviewed by: olce, adrian
Differential Revision: https://reviews.freebsd.org/D59596
