Author: brooks
Date: Mon Apr 24 22:37:54 2017
New Revision: 317391
URL: https://svnweb.freebsd.org/changeset/base/317391
Log:
MFC r316768:
Fix an out-of-bounds write when a zero-length buffer is passed.
Found with ttyname_test and CHERI bounds checking.
Reviewed by: emaste
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
Modified:
stable/11/lib/libc/gen/ttyname.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/lib/libc/gen/ttyname.c
==============================================================================
--- stable/11/lib/libc/gen/ttyname.c Mon Apr 24 22:35:00 2017
(r317390)
+++ stable/11/lib/libc/gen/ttyname.c Mon Apr 24 22:37:54 2017
(r317391)
@@ -61,6 +61,10 @@ ttyname_r(int fd, char *buf, size_t len)
{
size_t used;
+ /* Don't write off the end of a zero-length buffer. */
+ if (len < 1)
+ return (ERANGE);
+
*buf = '\0';
/* Must be a terminal. */
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
