On Sunday 06 September 2009 00:14:04 Bruce Cran wrote:
> >Number:         138559
> >Category:       usb
> >Synopsis:       [usb8] uether sysctl handler doesn't NUL-terminate the
> > string Confidential:   no
> >Severity:       non-critical
> >Priority:       low
> >Responsible:    freebsd-usb
> >State:          open
> >Quarter:
> >Keywords:
> >Date-Required:
> >Class:          sw-bug
> >Submitter-Id:   current-users
> >Arrival-Date:   Sat Sep 05 22:20:03 UTC 2009
> >Closed-Date:
> >Last-Modified:
> >Originator:     Bruce Cran
> >Release:        8.0-BETA3
> >Organization:
> >Environment:
>
> FreeBSD gluon.draftnet 8.0-BETA3 FreeBSD 8.0-BETA3 #1: Fri Sep  4 09:20:32
> BST 2009     [email protected]:/usr/obj/usr/src/sys/GENERIC  i386
>
> >Description:
>
> The sysctl handler in sys/dev/usb/net/usb_ethernet.c line 143 doesn't
> NUL-terminate the sysctl string returned to the user because it passes the
> length as "strlen(name)" instead of "strlen(name)+1".
>
> >How-To-Repeat:
> >
> >Fix:
>
> Patch attached with submission follows:
>
> --- usb_ethernet.c.orig       2009-09-05 21:35:09.000000000 +0100
> +++ usb_ethernet.c    2009-09-05 21:36:18.000000000 +0100
> @@ -146,7 +146,7 @@
>       const char *name;
>
>       name = device_get_nameunit(ue->ue_dev);
> -     return SYSCTL_OUT(req, name, strlen(name));
> +     return SYSCTL_OUT(req, name, strlen(name) + 1);
>  }
>
>  int
>
> >Release-Note:
> >Audit-Trail:
> >Unformatted:

Hi,

When plugging an USB ethernet adapter and printing out all sysctls, the parent 
string does not look corrupt. Are you sure that the terminating zero is not 
inserted somewhere else?

--HPS
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-usb
To unsubscribe, send any mail to "[email protected]"

Reply via email to