Date: Tue, 19 Apr 2016 16:48:15 +0000 (UTC) From: Sean Bruno <sbruno@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r298279 - head/sys/cam/ctl Message-ID: <201604191648.u3JGmFtd069884@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: sbruno Date: Tue Apr 19 16:48:14 2016 New Revision: 298279 URL: https://svnweb.freebsd.org/changeset/base/298279 Log: Plug memory leak in ctl(4) when ctl_copyin_args() is called with a non- null terminated ASCII string. PR: 207626 Submitted by: cturt@hardenedbsd.org MFC after: 2 days Modified: head/sys/cam/ctl/ctl.c Modified: head/sys/cam/ctl/ctl.c ============================================================================== --- head/sys/cam/ctl/ctl.c Tue Apr 19 15:56:39 2016 (r298278) +++ head/sys/cam/ctl/ctl.c Tue Apr 19 16:48:14 2016 (r298279) @@ -2445,6 +2445,7 @@ ctl_copyin_args(int num_args, struct ctl && (tmpptr[args[i].vallen - 1] != '\0')) { snprintf(error_str, error_str_len, "Argument " "%d value is not NUL-terminated", i); + free(tmpptr, M_CTL); goto bailout; } args[i].kvalue = tmpptr;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201604191648.u3JGmFtd069884>