Author: jhb
Date: Thu Oct 6 19:41:09 2016
New Revision: 306781
URL: https://svnweb.freebsd.org/changeset/base/306781
Log:
MFC 299458: Fix buffer overrun in gcore(1) NT_PRPSINFO
Use size of destination buffer, rather than a constant that may or may not
correspond to the source buffer, to restrict the length of copied strings. In
particular, pr_fname has 16+1 characters but MAXCOMLEN is 18+1.
Use strlcpy instead of strncpy to ensure the result is nul-terminated. This
seems to be what is expected of these fields.
Modified:
stable/10/usr.bin/gcore/elfcore.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/usr.bin/gcore/elfcore.c
==============================================================================
--- stable/10/usr.bin/gcore/elfcore.c Thu Oct 6 19:06:10 2016
(r306780)
+++ stable/10/usr.bin/gcore/elfcore.c Thu Oct 6 19:41:09 2016
(r306781)
@@ -564,8 +564,8 @@ elf_note_prpsinfo(void *arg, size_t *siz
err(1, "kern.proc.pid.%u", pid);
if (kip.ki_pid != pid)
err(1, "kern.proc.pid.%u", pid);
- strncpy(psinfo->pr_fname, kip.ki_comm, MAXCOMLEN);
- strncpy(psinfo->pr_psargs, psinfo->pr_fname, PRARGSZ);
+ strlcpy(psinfo->pr_fname, kip.ki_comm, sizeof(psinfo->pr_fname));
+ strlcpy(psinfo->pr_psargs, psinfo->pr_fname, sizeof(psinfo->pr_psargs));
*sizep = sizeof(*psinfo);
return (psinfo);
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "[email protected]"
