From: Rafael Sadowski <rafael@sizeofvoid.org>
Subject: relayd: replace memcpy/bcopy() with imsg_get_data()
To: tech@openbsd.org
Date: Tue, 28 Jul 2026 21:34:35 +0200

Replace  memcpy()/bcopy() with imsg_get_data(), which does a length
check.

OK?

diff --git a/hce.c b/hce.c
index 82f3003..05c1555 100644
--- a/hce.c
+++ b/hce.c
@@ -291,7 +291,8 @@ hce_dispatch_pfe(int fd, struct privsep_proc *p, struct imsg *imsg)
 
 	switch (imsg_get_type(imsg)) {
 	case IMSG_HOST_DISABLE:
-		memcpy(&id, imsg->data, sizeof(id));
+		if (imsg_get_data(imsg, &id, sizeof(id)) == -1)
+			return (-1);
 		if ((host = host_find(env, id)) == NULL)
 			fatalx("%s: desynchronized", __func__);
 		host->flags |= F_DISABLE;
@@ -301,7 +302,8 @@ hce_dispatch_pfe(int fd, struct privsep_proc *p, struct imsg *imsg)
 		host->he = HCE_NONE;
 		break;
 	case IMSG_HOST_ENABLE:
-		memcpy(&id, imsg->data, sizeof(id));
+		if (imsg_get_data(imsg, &id, sizeof(id)) == -1)
+			return (-1);
 		if ((host = host_find(env, id)) == NULL)
 			fatalx("%s: desynchronized", __func__);
 		host->flags &= ~(F_DISABLE);
@@ -309,7 +311,8 @@ hce_dispatch_pfe(int fd, struct privsep_proc *p, struct imsg *imsg)
 		host->he = HCE_NONE;
 		break;
 	case IMSG_TABLE_DISABLE:
-		memcpy(&id, imsg->data, sizeof(id));
+		if (imsg_get_data(imsg, &id, sizeof(id)) == -1)
+			return (-1);
 		if ((table = table_find(env, id)) == NULL)
 			fatalx("%s: desynchronized", __func__);
 		table->conf.flags |= F_DISABLE;
@@ -317,7 +320,8 @@ hce_dispatch_pfe(int fd, struct privsep_proc *p, struct imsg *imsg)
 			host->up = HOST_UNKNOWN;
 		break;
 	case IMSG_TABLE_ENABLE:
-		memcpy(&id, imsg->data, sizeof(id));
+		if (imsg_get_data(imsg, &id, sizeof(id)) == -1)
+			return (-1);
 		if ((table = table_find(env, id)) == NULL)
 			fatalx("%s: desynchronized", __func__);
 		table->conf.flags &= ~(F_DISABLE);
diff --git a/relay.c b/relay.c
index 412ae74..58e57b7 100644
--- a/relay.c
+++ b/relay.c
@@ -1870,7 +1870,8 @@ relay_dispatch_pfe(int fd, struct privsep_proc *p, struct imsg *imsg)
 
 	switch (imsg_get_type(imsg)) {
 	case IMSG_HOST_DISABLE:
-		memcpy(&id, imsg->data, sizeof(id));
+		if (imsg_get_data(imsg, &id, sizeof(id)) == -1)
+			return (-1);
 		if ((host = host_find(env, id)) == NULL)
 			fatalx("%s: desynchronized", __func__);
 		if ((table = table_find(env, host->conf.tableid)) ==
@@ -1882,14 +1883,16 @@ relay_dispatch_pfe(int fd, struct privsep_proc *p, struct imsg *imsg)
 		host->up = HOST_UNKNOWN;
 		break;
 	case IMSG_HOST_ENABLE:
-		memcpy(&id, imsg->data, sizeof(id));
+		if (imsg_get_data(imsg, &id, sizeof(id)) == -1)
+			return (-1);
 		if ((host = host_find(env, id)) == NULL)
 			fatalx("%s: desynchronized", __func__);
 		host->flags &= ~(F_DISABLE);
 		host->up = HOST_UNKNOWN;
 		break;
 	case IMSG_TABLE_DISABLE:
-		memcpy(&id, imsg->data, sizeof(id));
+		if (imsg_get_data(imsg, &id, sizeof(id)) == -1)
+			return (-1);
 		if ((table = table_find(env, id)) == NULL)
 			fatalx("%s: desynchronized", __func__);
 		table->conf.flags |= F_DISABLE;
@@ -1898,7 +1901,8 @@ relay_dispatch_pfe(int fd, struct privsep_proc *p, struct imsg *imsg)
 			host->up = HOST_UNKNOWN;
 		break;
 	case IMSG_TABLE_ENABLE:
-		memcpy(&id, imsg->data, sizeof(id));
+		if (imsg_get_data(imsg, &id, sizeof(id)) == -1)
+			return (-1);
 		if ((table = table_find(env, id)) == NULL)
 			fatalx("%s: desynchronized", __func__);
 		table->conf.flags &= ~(F_DISABLE);
@@ -1939,7 +1943,8 @@ relay_dispatch_pfe(int fd, struct privsep_proc *p, struct imsg *imsg)
 		host->up = st.up;
 		break;
 	case IMSG_NATLOOK:
-		bcopy(imsg->data, &cnl, sizeof(cnl));
+		if (imsg_get_data(imsg, &cnl, sizeof(cnl)) == -1)
+			return (-1);
 		if ((con = session_find(env, cnl.id)) == NULL ||
 		    con->se_cnl == NULL) {
 			log_debug("%s: session %d: expired",
@@ -2001,7 +2006,8 @@ relay_dispatch_parent(int fd, struct privsep_proc *p, struct imsg *imsg)
 
 	switch (imsg_get_type(imsg)) {
 	case IMSG_BINDANY:
-		bcopy(imsg->data, &id, sizeof(id));
+		if (imsg_get_data(imsg, &id, sizeof(id)) == -1)
+			return (-1);
 		if ((con = session_find(env, id)) == NULL) {
 			log_debug("%s: session %d: expired",
 			    __func__, id);