mirror of
https://github.com/opnsense/src.git
synced 2026-07-16 04:22:59 -04:00
The previous implementation used FD_SET() on a stack-allocated fd_set, which is an out-of-bounds write whenever the socket fd is >= FD_SETSIZE (1024). poll(2) takes an array indexed by slot rather than by fd value, so it has no FD_SETSIZE limit. Approved by: re Approved by: so Security: FreeBSD-SA-26:22.libcasper Security: CVE-2026-39461 Reported by: Joshua Rogers Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D56695 |
||
|---|---|---|
| .. | ||
| cap_main_test.c | ||
| Makefile | ||