A specially crafted ELF interpreter binary can trigger a KASSERT() in
vmcmd_map_readvn(). While this points at some deficiencies in
elf_load_file(), we have no intention to supporting such weirdly crafted
binaries (even if they're technically valid). So return EINVAL instead.
ok deraadt@
TIOCGSID can dereference a freed t_session, because we are storing s_leader
in the wrong place. This is a cold hard crash crashes. Some folk are
looking at fixing this properly but it will take some time, so in the meantime
we should just fail the ioctl.
From Acts1632, ok kettenis
devel/py-test-check: update to 2.9.1
ok and suggestion to explicitly list sysutils/py-packaging as a runtime
dependency (instead of indirectly depending on it through devel/pytest) by tb@
Specify the correct "read" and "write" bits to the NVMMU based on the
opcode of the NVMe command. Drop the opcode itself, since it isn't needed.
This allows us to drop the magic "null check" bit that is no longer
supported by the firmware that Apple ships with newer macOS releases.
Based on work done by Sven Peter over at Asahi Linux.
ok jmatthew@
Prevent read buffer overflow in verbose debug logging.
When we receive more than 8 nameservers in a DHCP lease we would
overread the nameservers buffer because the loop was not bounded by
items in the array but the whole size.
Pointed out by Stuart Thomas some time ago, thanks!
isakmpd: Handle malformed MONITOR_BIND message
Using a stack allocated sockaddr_storage avoids the malloc(3)
entirely. Add length checks for the payload sent by the child.
When a malicious child sends us a malformed message the privsep
protocol is out of sync. Thus terminate gracefully with log_fatalx().
While there, attribute log_fatalx() with __dead.
Reported by Shibo, Hugo Systopia Team
ok markus@ tb@ deraadt@
