A malicious value of size in a structure of packed libnv can cause an…

… integer

overflow, leading to the allocation of a smaller buffer than required for the
parsed data. The introduced check was incorrect, as it took into account the
size of the pointer, not the structure. This vulnerability affects both
kernel and userland.

sys/contrib/libnv/nvlist.c

@@ -1027,6 +1027,10 @@ nvlist_pack(const nvlist_t *nvl, size_t *sizep)
 static bool
 nvlist_check_header(struct nvlist_header *nvlhdrp)
 {
+	if (nvlhdrp->nvlh_size > SIZE_MAX - sizeof(*nvlhdrp)) {
+ 		ERRNO_SET(EINVAL);
+ 		return (false);
+ 	}
 
 	if (nvlhdrp->nvlh_magic != NVLIST_HEADER_MAGIC) {
 		ERRNO_SET(EINVAL);