I was playing with afl a few weeks ago and found this.  I believe it is 
triggered by non-sequential timestamp records, but I didn’t dig into it or run 
afl for particularly long.  The patch below fixed all the crashes afl had found 
up to that point.

The string used doesn’t matter, ‘crmsg’ just needs to be initialized in case 
there isn’t a ‘~’ entry prior to needing to use it.

Thanks.

--david

Index: last.c
===================================================================
RCS file: /cvs/src/usr.bin/last/last.c,v
retrieving revision 1.43
diff -u -p -r1.43 last.c
--- last.c      26 Nov 2014 18:34:51 -0000      1.43
+++ last.c      27 Nov 2014 14:36:45 -0000
@@ -241,7 +241,7 @@ wtmp(void)
 {
        time_t  delta, total = 0;
        int     timesize, wfd, snapfound = 0;
-       char    *ct, *crmsg;
+       char    *ct, *crmsg = "invalid";
        struct utmp     *bp;
        struct stat     stb;
        ssize_t bytes;


Reply via email to