git: jail: Fix potential buffer overflow in sysctl_jail_list()
Aaron LI
aly at crater.dragonflybsd.org
Sat Aug 1 20:58:28 PDT 2026
commit fdf5103faa719160d8eeddf8fdea6c6bcccb19fd
Author: Aaron LI <aly at aaronly.me>
Date: Sun Aug 2 10:32:36 2026 +0800
jail: Fix potential buffer overflow in sysctl_jail_list()
sysctl_jail_list() allocates a buffer of size = count*1024, and then
uses ksnprintf() to format the jail information and advance the write
position. However, ksnprintf() returns the would-be length (i.e., the
number of bytes would be written if the buffer is big enough). So a jail
that has a very long path and/or many IPs would overflow the allocated
buffer.
Fix the bug by correctly handling the return value of ksnprintf().
GitHub-PR: #45
Reported-by: Nathan Sapwell (jewbird)
Summary of changes:
sys/kern/kern_jail.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/fdf5103faa719160d8eeddf8fdea6c6bcccb19fd
--
DragonFly BSD source repository
More information about the Commits
mailing list