The branch main has been updated by des: URL: https://cgit.FreeBSD.org/src/commit/?id=911bda7cffbf358c4e83ea05cfe980d429aff61c
commit 911bda7cffbf358c4e83ea05cfe980d429aff61c Author: Dag-Erling Smørgrav <[email protected]> AuthorDate: 2026-09-05 15:44:05 +0000 Commit: Dag-Erling Smørgrav <[email protected]> CommitDate: 2026-09-05 15:44:34 +0000 hastd: Ensure nvpair padding is initialized The proto-libnv implementation embedded in hastd pads names and values out to the nearest multiple of eight bytes, but leaves the padding uninitialized, leaking up to 14 bytes of recycled heap per pair in a message. While here, switch from bcopy() to memcpy(). MFC after: 3 days Reviewed by: kevans, emaste Differential Revision: https://reviews.freebsd.org/D59343 --- sbin/hastd/nv.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sbin/hastd/nv.c b/sbin/hastd/nv.c index 16ab95cf0dc6..87d59c6929b9 100644 --- a/sbin/hastd/nv.c +++ b/sbin/hastd/nv.c @@ -500,7 +500,7 @@ nv_get_##type(struct nv *nv, const char *namefmt, ...) \ return (0); \ PJDLOG_ASSERT((nvh->nvh_type & NV_ORDER_MASK) == NV_ORDER_HOST);\ PJDLOG_ASSERT(sizeof(value) == nvh->nvh_dsize); \ - bcopy(NVH_DATA(nvh), &value, sizeof(value)); \ + memcpy(&value, NVH_DATA(nvh), sizeof(value)); \ \ return (value); \ } @@ -767,7 +767,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type, namesize = strlen(name) + 1; - nvh = malloc(sizeof(*nvh) + roundup2(namesize, 8)); + nvh = calloc(1, sizeof(*nvh) + roundup2(namesize, 8)); if (nvh == NULL) { if (nv->nv_error == 0) nv->nv_error = ENOMEM; @@ -776,7 +776,7 @@ nv_add(struct nv *nv, const unsigned char *value, size_t vsize, int type, nvh->nvh_type = NV_ORDER_HOST | type; nvh->nvh_namesize = (uint8_t)namesize; nvh->nvh_dsize = (uint32_t)vsize; - bcopy(name, nvh->nvh_name, namesize); + memcpy(nvh->nvh_name, name, namesize); /* Add header first. */ if (ebuf_add_tail(nv->nv_ebuf, nvh, NVH_HSIZE(nvh)) == -1) {
