<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>

<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>


<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">

<h3 style="margin-top: 20px; margin-bottom: 10px;">
Gary E. Miller pushed to branch master at <a href="https://gitlab.com/NTPsec/ntpsec">NTPsec / ntpsec</a>
</h3>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
Commits:
</h4>
<ul>
<li>
<strong style="font-weight: 600;"><a href="https://gitlab.com/NTPsec/ntpsec/-/commit/97be66b43ed90d64c1eb314fd91638fb78f05b5e">97be66b4</a></strong>
<div>
<span> by Matt Selsky </span> <i> at 2026-10-13T16:44:51-07:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #f7f7f5; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdbd9;'>ntpd/nts.c: stop find_end_marker() at a partial record

find_end_marker() advanced buff by each record's length before checking
that the record fit in the bytes read so far. A record whose length runs
past the data left buff pointing beyond the end of the buffer, which is
undefined behavior even though it was never dereferenced, and Coverity
reports the untrusted length as a loop bound (CID 657248).

Return false as soon as a record extends past the data read. The result
is the same, since the caller keeps reading until the end marker
arrives.
</pre>
</li>
</ul>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
1 changed file:
</h4>
<ul>
<li class="file-stats">
<a href="#836f284fe6d0339c4bd3d19bbd081050718f85e0">
ntpd/nts.c
</a>
</li>
</ul>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
Changes:
</h4>
<li id="836f284fe6d0339c4bd3d19bbd081050718f85e0">
<a href="https://gitlab.com/NTPsec/ntpsec/-/commit/97be66b43ed90d64c1eb314fd91638fb78f05b5e#836f284fe6d0339c4bd3d19bbd081050718f85e0"><strong style="font-weight: 600;">ntpd/nts.c</strong></a>
<hr style="overflow: hidden; border: 1px solid #dcdbd9;">
<table class="code white" style="border-spacing: 0; border-collapse: collapse; width: auto; font-family: monospace; font-size: 90%;" bgcolor="#ffffff" width="100%" cellpadding="0" cellspacing="0">
<tr class="line_holder match" style="line-height: 1.6;">
<td class="diff-line-num unfold js-unfold old_line" data-linenumber="295" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #ecebea; border-right-style: solid; padding: inherit;" align="right" bgcolor="#f7f7f5">...</td>
<td class="diff-line-num unfold js-unfold new_line" data-linenumber="295" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #ecebea; border-right-style: solid; padding: inherit;" align="right" bgcolor="#f7f7f5">...</td>
<td class="line_content match" style="color: rgba(5,5,6,.24); padding: inherit;" bgcolor="#f7f7f5">@@ -295,6 +295,7 @@ static bool find_end_marker(uint8_t *buff, int bytes) {</td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="295" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #ecebea; border-right-style: solid; padding: inherit;" align="right" bgcolor="#f7f7f5">
295
</td>
<td class="new_line diff-line-num" data-linenumber="295" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #ecebea; border-right-style: solid; padding: inherit;" align="right" bgcolor="#f7f7f5">
295
</td>
<td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdbd9;'> <span class="line" data-lang="c">    <span class="kt" style="color: #445588; font-weight: 600;">uint16_t</span> <span class="o" style="font-weight: 600;">*</span><span class="n" style="color: #333333;">buff16</span> <span class="o" style="font-weight: 600;">=</span> <span class="p">(</span><span class="kt" style="color: #445588; font-weight: 600;">uint16_t</span> <span class="o" style="font-weight: 600;">*</span><span class="p">)</span><span class="n" style="color: #333333;">buff</span><span class="p">;</span></span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="296" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #ecebea; border-right-style: solid; padding: inherit;" align="right" bgcolor="#f7f7f5">
296
</td>
<td class="new_line diff-line-num" data-linenumber="296" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #ecebea; border-right-style: solid; padding: inherit;" align="right" bgcolor="#f7f7f5">
296
</td>
<td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdbd9;'> <span class="line" data-lang="c">    <span class="kt" style="color: #445588; font-weight: 600;">uint16_t</span> <span class="n" style="color: #333333;">type</span> <span class="o" style="font-weight: 600;">=</span> <span class="n" style="color: #333333;">ntohs</span><span class="p">(</span><span class="o" style="font-weight: 600;">*</span><span class="n" style="color: #333333;">buff16</span><span class="o" style="font-weight: 600;">++</span><span class="p">)</span> <span class="o" style="font-weight: 600;">&</span> <span class="o" style="font-weight: 600;">~</span><span class="n" style="color: #333333;">NTS_CRITICAL</span><span class="p">;</span></span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="297" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #ecebea; border-right-style: solid; padding: inherit;" align="right" bgcolor="#f7f7f5">
297
</td>
<td class="new_line diff-line-num" data-linenumber="297" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #ecebea; border-right-style: solid; padding: inherit;" align="right" bgcolor="#f7f7f5">
297
</td>
<td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdbd9;'> <span class="line" data-lang="c">    <span class="kt" style="color: #445588; font-weight: 600;">uint16_t</span> <span class="n" style="color: #333333;">length</span> <span class="o" style="font-weight: 600;">=</span> <span class="n" style="color: #333333;">ntohs</span><span class="p">(</span><span class="o" style="font-weight: 600;">*</span><span class="n" style="color: #333333;">buff16</span><span class="o" style="font-weight: 600;">++</span><span class="p">);</span></span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="298" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
 
</td>
<td class="new_line diff-line-num new" data-linenumber="298" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
298
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdbd9;'>+<span class="line" data-lang="c">    <span class="k" style="font-weight: 600;">if</span> <span class="p">(</span><span class="n" style="color: #333333;">NTS_KE_HDR_LNG</span> <span class="o" style="font-weight: 600;">+</span> <span class="n" style="color: #333333;">length</span> <span class="o" style="font-weight: 600;">></span> <span class="n" style="color: #333333;">bytes</span><span class="p">)</span> <span class="k" style="font-weight: 600;">return</span> <span class="nb" style="color: #0086b3;">false</span><span class="p">;</span></span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="298" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #ecebea; border-right-style: solid; padding: inherit;" align="right" bgcolor="#f7f7f5">
298
</td>
<td class="new_line diff-line-num" data-linenumber="299" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #ecebea; border-right-style: solid; padding: inherit;" align="right" bgcolor="#f7f7f5">
299
</td>
<td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdbd9;'> <span class="line" data-lang="c">    <span class="k" style="font-weight: 600;">if</span> <span class="p">(</span><span class="n" style="color: #333333;">nts_end_of_message</span> <span class="o" style="font-weight: 600;">==</span> <span class="n" style="color: #333333;">type</span><span class="p">)</span> <span class="k" style="font-weight: 600;">return</span> <span class="nb" style="color: #0086b3;">true</span><span class="p">;</span></span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="299" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #ecebea; border-right-style: solid; padding: inherit;" align="right" bgcolor="#f7f7f5">
299
</td>
<td class="new_line diff-line-num" data-linenumber="300" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #ecebea; border-right-style: solid; padding: inherit;" align="right" bgcolor="#f7f7f5">
300
</td>
<td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdbd9;'> <span class="line" data-lang="c">    <span class="n" style="color: #333333;">buff</span> <span class="o" style="font-weight: 600;">+=</span> <span class="n" style="color: #333333;">NTS_KE_HDR_LNG</span> <span class="o" style="font-weight: 600;">+</span> <span class="n" style="color: #333333;">length</span><span class="p">;</span></span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="300" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #ecebea; border-right-style: solid; padding: inherit;" align="right" bgcolor="#f7f7f5">
300
</td>
<td class="new_line diff-line-num" data-linenumber="301" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #ecebea; border-right-style: solid; padding: inherit;" align="right" bgcolor="#f7f7f5">
301
</td>
<td class="line_content" style="padding: inherit;"><pre style='display: block; font-size: 14px; color: #3a383d; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdbd9;'> <span class="line" data-lang="c">    <span class="n" style="color: #333333;">bytes</span> <span class="o" style="font-weight: 600;">-=</span> <span class="n" style="color: #333333;">NTS_KE_HDR_LNG</span> <span class="o" style="font-weight: 600;">+</span> <span class="n" style="color: #333333;">length</span><span class="p">;</span></span>
</pre></td>
</tr>

</table>
<br>
</li>

</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #646163;">
—
<br>
<a href="https://gitlab.com/NTPsec/ntpsec/-/commit/97be66b43ed90d64c1eb314fd91638fb78f05b5e">View it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.com">gitlab.com</a>. <a href="https://gitlab.com/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.com/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<span style="color: transparent; font-size: 0; display: none; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">Notification message regarding https://gitlab.com/NTPsec/ntpsec/-/commit/97be66b43ed90d64c1eb314fd91638fb78f05b5e at 07a9bab2b15296021210bc11fd09595e</span>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Commit","url":"https://gitlab.com/NTPsec/ntpsec/-/commit/97be66b43ed90d64c1eb314fd91638fb78f05b5e"}}</script>


</p>
</div>
</body>
</html>