only allow an NFS server to set file type on a new vnode
Otherwise, a malicous server could aid a local user in avoiding access
controls.
This reverts nfs_subs.c rev 1.3. Which was part of a commit to fix the
use of automount with direct maps.
reported by Andrew Griffiths
from jsg@
this is errata/7.9/016_nfs.patch.sig
only allow an NFS server to set file type on a new vnode
Otherwise, a malicous server could aid a local user in avoiding access
controls.
This reverts nfs_subs.c rev 1.3. Which was part of a commit to fix the
use of automount with direct maps.
reported by Andrew Griffiths
from jsg@
this is errata/7.8/052_nfs.patch.sig
Clamp numeric arguments of terminal escape sequences to an arbitrary value of
100,000. The existing logic would happily process as many digits as provided,
which could make the values wraparound at 2**32, or be considered as negative
values if cast to a signed type, leading to incorrect processing.
Bug report by Acts1631.
from miod@
this is errata/7.9/017_wscons.patch.sig
Clamp numeric arguments of terminal escape sequences to an arbitrary value of
100,000. The existing logic would happily process as many digits as provided,
which could make the values wraparound at 2**32, or be considered as negative
values if cast to a signed type, leading to incorrect processing.
Bug report by Acts1631.
from miod@
this is errata/7.8/053_wscons.patch.sig
sys/uvm: validate anonymous object pager requests
uao_get() trusts the requested page range before allocating pages and
looking up swap slots; an invalid request can therefore allocate a page
outside the object and read beyond its swap slot array. Validate the
request before page lookup or allocation, preserving optional fault
clustering at the object boundary.
Reject nonpositive page counts and starting page indices outside the
object; require the entire range for PGO_ALLPAGES, or a centeridx within
both the request and the object otherwise. Compare against the remaining
page count in voff_t and derive pageidx from the validated firstpage,
avoiding overflow in the bounds check and unchecked narrowing.
Reported by Andrew Griffiths, thanks!
from kirill@; OK kettenis@
this is errata/7.9/018_shmat.patch.sig
sys/uvm: validate anonymous object pager requests
uao_get() trusts the requested page range before allocating pages and
looking up swap slots; an invalid request can therefore allocate a page
outside the object and read beyond its swap slot array. Validate the
request before page lookup or allocation, preserving optional fault
clustering at the object boundary.
Reject nonpositive page counts and starting page indices outside the
object; require the entire range for PGO_ALLPAGES, or a centeridx within
both the request and the object otherwise. Compare against the remaining
page count in voff_t and derive pageidx from the validated firstpage,
avoiding overflow in the bounds check and unchecked narrowing.
Reported by Andrew Griffiths, thanks!
from kirill@; OK kettenis@
this is errata/7.8/054_shmat.patch.sig
Backport all changes from libexpat version 2.8.4.
Relevant for OpenBSD are security fixes #1321 #1331 #1322, other
changes #1315 #1325 #1334 #1340 #1319 #1320. Library bump is not
necessary.
CVE-2026-66046CVE-2026-76641CVE-2026-76957
from bluhm@; OK tb@
this is errata/7.9/019_expat.patch.sig
Backport all changes from libexpat version 2.8.4.
Relevant for OpenBSD are security fixes #1321 #1331 #1322, other
changes #1315 #1325 #1334 #1340 #1319 #1320. Library bump is not
necessary.
CVE-2026-66046CVE-2026-76641CVE-2026-76957
from bluhm@; OK tb@
this is errata/7.8/055_expat.patch.sig
Assign connections a 64 bit identifier rather than using the socket fd to
identify them between subprocesses.
Based on a report from Franz Bettag of Bettag Systems
from jmatthew@; OK deraadt@
this is errata/7.9/021_ldapd.patch.sig
Assign connections a 64 bit identifier rather than using the socket fd to
identify them between subprocesses.
Based on a report from Franz Bettag of Bettag Systems
from jmatthew@; OK deraadt@
this is errata/7.8/057_ldapd.patch.sig
Tor Browser: update to 15.0.22
basically a noop because Tor Browser 15.0.22 just updates Tor,
which for us is not bundled but provided through net/tor.
Fix a logic error in post_bl() that could cause a NULL pointer access.
When a column list does not use explicit .It macros and contains
at least one text line followed by a node generated on the roff(7)
level, for example an eqn(7) node, and then nothing more, in
particular no following .It macro, the code wraps the node generated
on the roff level in an implicit .It macro. After moving the node
into the new .It macro, the loop variable "nchild" iterating over
the children of .Bl must be set to NULL to exit the while loop.
Instead, the loop variable remained pointing at the moved node, and
the loop tried to move it again, resulting in an access to its
"prev" pointer, which is of course NULL in this situation.
Hippolyte Doncieu de la Batie <hippolyte.doncieu at gmail.com>
found this bug using clang-14 with libFuzzer
and drafted an almost correct patch to fix it.
The first half of his patch was correct;
i slightly rearranged it with no functional change
to make the code two lines shorter and easier to read.
[4 lines not shown]
