John Baldwin 7485e6a867 telnet: Prevent buffer overflow in the user prompt for SRA ... The Secure RPC authenticator for telnet prompts the local user for the username to use for authentication. Previously it was using sprintf() into a buffer of 256 bytes, but the username received over the wire can be up to 255 bytes long which would overflow the prompt buffer. Fix this in two ways: First, use snprintf() and check for overflow. If the prompt buffer overflows, fail authentication without prompting the user. Second, add 10 bytes to the buffer size to account for the overhead of the prompt so that a maximally sized username fits. While here, replace a bare 255 in the subsequent telnet_gets call with an expression using sizeof() the relevant buffer. PR: 270263 Reported by: Robert Morris <rtm@lcs.mit.edu> Tested on: CHERI Reviewed by: emaste Differential Revision: https://reviews.freebsd.org/D49832 (cherry picked from commit 5737c2ae06e143e49496df2ab5a64f76d5456012)		2025-04-29 10:45:52 -04:00
..
arm-optimized-routines	Update the Arm Optimized Routine library to v24.01	2024-04-08 13:15:18 +00:00
atf	atf: Guard against multiple evaluation.	2024-05-20 09:04:54 +00:00
bc	vendor/bc: upgrade to version 7.0.2	2024-09-24 18:33:30 +02:00
bearssl	Merge commit 'd84e570b54961e8874bbd8de25635eb96be0977e'	2023-02-20 22:13:27 -08:00
bionic-x86_64-string	Import bionic's x86_64 optimized string routines	2022-08-16 13:27:11 -04:00
blocklist	blocklistd: Remove obsolete network class reference	2025-02-07 10:56:56 -05:00
bmake	Merge bmake-20230622	2023-06-27 13:57:58 -07:00
bsddialog	contrib/bsddialog: Import version 0.4	2022-09-25 15:09:16 +02:00
bsnmp	libbsnmp: avoid division by zero with empty password	2025-01-20 09:25:14 -05:00
byacc	byacc: Adjust expected test output to match our patches.	2023-02-22 20:05:02 +01:00
bzip2	bzip2: remove locally added __FBSDID	2023-12-13 23:08:50 +00:00
capsicum-test	capsicum-test: rights are propagated on sctp_peeloff(2)	2024-10-17 12:29:21 -04:00
com_err
dialog
diff	gnu diff3: apply patch to committed src, rather than at build time	2022-11-13 21:33:40 -05:00
dma	dma: use OpenSSL 1.1 init API	2023-05-11 19:03:34 -04:00
ee	ee: Fix use of uninitialised pointer in ispell_op	2024-09-07 01:01:06 +01:00
elftoolchain	libelftc: Fix a typo - FreeBSD's riscv port is little-endian.	2025-01-24 14:48:56 -05:00
expat	contrib/expat: import expat 2.7.1	2025-04-05 11:17:53 +08:00
file	MFC: MFV: file 5.46.	2024-12-21 23:37:20 -08:00
flex	contrib/flex: Drop local __dead2 patch	2021-04-21 10:54:59 +01:00
gdtoa
googletest	contrib/googletest: update from 1.14.0 to 1.15.2	2025-03-25 13:21:40 -07:00
hyperv/tools	hyperv/kvp: Remove set but unused variables.	2023-06-27 10:19:32 -07:00
jemalloc	jemalloc: set LG_VADDR to 64 on amd64	2024-10-15 18:06:44 +03:00
kyua	kyua: Pass unprivileged user config prop to ATF using all known names	2025-03-16 10:46:22 +00:00
ldns	ldns: Ignore commented-out lines in resolv.conf.	2024-05-20 09:04:54 +00:00
ldns-host
less	MFC: MFV: less v668.	2024-12-21 23:46:59 -08:00
lib9p	lib9p: Remove set but unused sockets[] array from l9p_start_server.	2023-06-20 09:28:59 -07:00
libarchive	libarchive: backport PR #2386 (fixes output of one test)	2024-10-27 09:45:56 +01:00
libbegemot
libc-pwcache	Remove __FBSDID from netbsd libc sources	2023-12-13 23:08:50 +00:00
libc-vis	Remove __FBSDID from netbsd libc sources	2023-12-13 23:08:50 +00:00
libcbor	libcbor: vendor update to 0.11.0	2024-08-01 11:11:45 -04:00
libcxxrt	libcxxrt: Update to upstream 6f2fdfebcd62	2024-11-03 09:51:37 -05:00
libder	Add 'contrib/libder/' from commit '9c40c4de4c33b2ba1124fb752ebea0bebaa6013f'	2025-01-10 20:48:21 -06:00
libdivsufsort
libedit	libedit: update to snapshot 2023-01-06	2023-02-06 14:25:06 +01:00
libevent	libevent: Import libevent 2.1.12	2023-11-28 07:15:25 -08:00
libexecinfo
libfido2	libfido2: update to 1.14.0	2024-08-01 11:11:45 -04:00
libpcap	libpcap: Update to 1.10.5	2024-10-07 14:27:04 -03:00
libucl	libucl: import snapshot 2024-02-06	2024-03-27 09:18:47 +01:00
libxo	Merge commit '7087c8de43b0d5d27c52da6ba2ba4957b7e336ff' into new_merge	2023-01-30 00:04:21 -05:00
llvm-project	Merge llvm-project release/19.x llvmorg-19.1.7-0-gcd708029e0b2	2025-01-19 12:05:53 +01:00
lua	Merge LUA 5.4.6	2023-07-15 11:31:04 -06:00
lutok
mandoc	timeout(1): Update STANDARDS section	2024-10-18 08:56:48 +02:00
mknod
mtree
ncurses	ncurses: readd 2 html files in the doc (fix MK_HTML=yes)	2024-06-27 11:06:23 +02:00
netbsd-tests	netbsd-tests: Update a test case to chase grep symlink handling changes	2025-03-31 14:27:25 -07:00
netcat	netcat: Allow nc to be an if_tun tunnel broker	2023-01-17 10:05:49 +00:00
ntp	ntp: Replace the workaround from 98e34e8e2557 with a patch from upstream	2025-03-19 21:26:46 -07:00
nvi	nvi: import version 2.2.1-52c07e8	2025-01-15 10:55:01 +01:00
ofed	libibverbs: Extend support of NDR rates	2025-03-22 02:27:55 +02:00
one-true-awk	ota: Merge One True Awk 20250116 bsd-feature 2dce54b053d4	2025-02-06 08:10:46 -07:00
openbsm	libbsm: honour AU_OFLAG_NORESOLVE	2024-11-12 08:40:05 -05:00
opencsd/decoder	Import OpenCSD v.1.4.0.	2023-03-27 17:03:16 +01:00
openpam	openpam: Migrate from COMPAT_32BIT to generic COMPAT_libcompat	2023-07-09 18:48:17 +01:00
openresolv
pam_modules/pam_passwdqc
pf	libpcap: Update to 1.10.5	2024-10-07 14:27:04 -03:00
pjdfstest
pnglite
pnpinfo	pnpinfo: remove locally added __FBSDID	2023-12-13 23:08:50 +00:00
processor-trace
sendmail	Merge commit '850ef5ae11d69ea3381bd310f564f025fc8caea3'	2024-02-07 02:29:43 +00:00
smbfs	smbfs manuals: describe consistently	2024-06-12 15:46:25 -06:00
spleen	contrib/spleen: Update to Spleen 2.1.0	2025-01-24 14:57:10 -05:00
sqlite3	sqlite3: Vendor import of sqlite3 3.46.1	2024-09-02 17:01:33 -07:00
tcp_wrappers	tcp_wrappers: Use default C standard version	2025-01-24 14:50:38 -05:00
tcpdump	tcpdump/print-pflog: Print uid with host endianness	2025-01-13 22:49:14 -04:00
tcsh	tcsh: update to version 6.22.04.	2021-05-20 00:12:27 +03:00
telnet	telnet: Prevent buffer overflow in the user prompt for SRA	2025-04-29 10:45:52 -04:00
terminus	contrib/terminus: update to terminus-font-4.49.1	2022-02-02 15:42:18 +02:00
tnftp
traceroute	traceroute: Implement ECN bleaching detection	2024-02-02 09:32:24 -05:00
tzcode	Update tzcode to 2024b.	2024-10-06 09:12:49 +00:00
tzdata	contrib/tzdata: import tzdata 2025b	2025-03-26 09:03:52 +08:00
unbound	unbound: Remove testcode and testdata	2024-10-24 20:28:45 -07:00
unifdef	unifdef: Fix collision check when adding symbols.	2025-02-13 01:37:42 +01:00
unvis
vis	Merge tag 'vendor/NetBSD/vis/20210621' into vis	2021-06-21 18:04:17 -06:00
wireguard-tools	wireguard-tools: ipc: freebsd: use AF_LOCAL for the control socket	2025-04-25 22:19:49 -05:00
wpa	contrib/wpa: pass IFM_IEEE80211_VHT5G if vht_enabled on the channel	2025-02-10 14:52:12 +00:00
xz	MFC: MFV: xz 5.6.3	2024-12-21 23:32:54 -08:00