From 3aaaca1b51ad844ef9e9b3d945217ab3dd189bae Mon Sep 17 00:00:00 2001
From: Mariusz Zaborski <oshogbo@FreeBSD.org>
Date: Mon, 26 Aug 2024 20:20:24 +0200
Subject: [PATCH] libnv: verify that string is null terminated

During unpacking, we ensure that we do not read beyond the
declared size. However, unpack uses a function that copies
null-terminated strings. Prior to this commit, if the last string
was not null-terminated, it could result in copying data into a
buffer smaller than the allocated size.

Security:       FreeBSD-24:09.libnv
Security:       CVE-2024-45288
Security:       CAP-03
Reported by:    Synacktiv
Sponsored by:   The Alpha-Omega Project
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D46138
---
 sys/contrib/libnv/bsd_nvpair.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sys/contrib/libnv/bsd_nvpair.c b/sys/contrib/libnv/bsd_nvpair.c
index 9560ebc74f83..a977d7941aa3 100644
--- a/sys/contrib/libnv/bsd_nvpair.c
+++ b/sys/contrib/libnv/bsd_nvpair.c
@@ -988,6 +988,10 @@ nvpair_unpack_string_array(bool isbe __unused, nvpair_t *nvp,
 	for (ii = 0; ii < nvp->nvp_nitems; ii++) {
 		len = strnlen(tmp, size - 1) + 1;
 		size -= len;
+		if (tmp[len - 1] != '\0') {
+			ERRNO_SET(EINVAL);
+			return (NULL);
+		}
 		if (size < 0) {
 			ERRNO_SET(EINVAL);
 			return (NULL);