From owner-svn-src-head@FreeBSD.ORG  Fri Dec 21 22:21:00 2012
Return-Path: <owner-svn-src-head@FreeBSD.ORG>
Delivered-To: svn-src-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
 by hub.freebsd.org (Postfix) with ESMTP id 760F25DC;
 Fri, 21 Dec 2012 22:21:00 +0000 (UTC)
 (envelope-from delphij@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 by mx1.freebsd.org (Postfix) with ESMTP id 412C58FC0A;
 Fri, 21 Dec 2012 22:21:00 +0000 (UTC)
Received: from svn.freebsd.org (localhost [127.0.0.1])
 by svn.freebsd.org (8.14.5/8.14.5) with ESMTP id qBLML0rI049790;
 Fri, 21 Dec 2012 22:21:00 GMT (envelope-from delphij@svn.freebsd.org)
Received: (from delphij@localhost)
 by svn.freebsd.org (8.14.5/8.14.5/Submit) id qBLML0vS049788;
 Fri, 21 Dec 2012 22:21:00 GMT (envelope-from delphij@svn.freebsd.org)
Message-Id: <201212212221.qBLML0vS049788@svn.freebsd.org>
From: Xin LI <delphij@FreeBSD.org>
Date: Fri, 21 Dec 2012 22:21:00 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Subject: svn commit: r244568 - head/lib/libc/gen
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
 <svn-src-head.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 21 Dec 2012 22:21:00 -0000

Author: delphij
Date: Fri Dec 21 22:20:59 2012
New Revision: 244568
URL: http://svnweb.freebsd.org/changeset/base/244568

Log:
   - Reduce buffer size from LINE_MAX to PATH_MAX, there is no point to store
     path longer than this.
   - Fix an unreached case of check against sizeof buf, which in turn leads
     to an off-by-one nul byte write on the stack.  The original condition
     can never be satisfied because the passed boundary is the maximum value
     that can be returned, so code was harmless.
  
  MFC after:	1 month

Modified:
  head/lib/libc/gen/check_utility_compat.c

Modified: head/lib/libc/gen/check_utility_compat.c
==============================================================================
--- head/lib/libc/gen/check_utility_compat.c	Fri Dec 21 21:41:23 2012	(r244567)
+++ head/lib/libc/gen/check_utility_compat.c	Fri Dec 21 22:20:59 2012	(r244568)
@@ -35,32 +35,28 @@ __FBSDID("$FreeBSD$");
  * are threaded, so I'm not concerned about cancellation points or other
  * niceties.
  */
+#include <sys/limits.h>
+
 #include <limits.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 
-#ifndef LINE_MAX
-#define	LINE_MAX _POSIX2_LINE_MAX
-#endif
-
 #define	_PATH_UTIL_COMPAT	"/etc/compat-FreeBSD-4-util"
 #define	_ENV_UTIL_COMPAT	"_COMPAT_FreeBSD_4"
 
 int
 check_utility_compat(const char *utility)
 {
-	char buf[LINE_MAX];
+	char buf[PATH_MAX];
 	char *p, *bp;
 	int len;
 
 	if ((p = getenv(_ENV_UTIL_COMPAT)) != NULL) {
 		strlcpy(buf, p, sizeof buf);
 	} else {
-		if ((len = readlink(_PATH_UTIL_COMPAT, buf, sizeof buf)) < 0)
+		if ((len = readlink(_PATH_UTIL_COMPAT, buf, sizeof(buf) - 1)) < 0)
 			return 0;
-		if (len > sizeof buf)
-			len = sizeof buf;
 		buf[len] = '\0';
 	}
 	if (buf[0] == '\0')