git: jail: Fix potential buffer overflow in sysctl_jail_list()

Aaron LI aly at crater.dragonflybsd.org
Sat Aug 1 20:58:28 PDT 2026


commit fdf5103faa719160d8eeddf8fdea6c6bcccb19fd
Author: Aaron LI <aly at aaronly.me>
Date:   Sun Aug 2 10:32:36 2026 +0800

    jail: Fix potential buffer overflow in sysctl_jail_list()
    
    sysctl_jail_list() allocates a buffer of size = count*1024, and then
    uses ksnprintf() to format the jail information and advance the write
    position. However, ksnprintf() returns the would-be length (i.e., the
    number of bytes would be written if the buffer is big enough). So a jail
    that has a very long path and/or many IPs would overflow the allocated
    buffer.
    
    Fix the bug by correctly handling the return value of ksnprintf().
    
    GitHub-PR: #45
    Reported-by: Nathan Sapwell (jewbird)

Summary of changes:
 sys/kern/kern_jail.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/fdf5103faa719160d8eeddf8fdea6c6bcccb19fd


-- 
DragonFly BSD source repository


More information about the Commits mailing list