Date: Sun, 3 Jan 2016 07:37:47 +0000 (UTC) From: Garrett Cooper <ngie@FreeBSD.org> To: src-committers@freebsd.org, svn-src-user@freebsd.org Subject: svn commit: r293081 - user/ngie/stable-10-libnv/sys/kern Message-ID: <201601030737.u037blL5098354@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: ngie Date: Sun Jan 3 07:37:46 2016 New Revision: 293081 URL: https://svnweb.freebsd.org/changeset/base/293081 Log: MFC r282337,r283157: r282337 (by bz): Fix an off-by-one bug in string/array handling which lead to memory overwrite and follow-up assertion errors on at least ARM after r282257, with nvp_magic being 0x6e7600: Assertion failed: ((nvp)->nvp_magic == 0x6e7670), function nvpair_name, file .../subr_nvpair.c, line 713. r283157 (by oshogbo): Style. Modified: user/ngie/stable-10-libnv/sys/kern/subr_nvpair.c Directory Properties: user/ngie/stable-10-libnv/ (props changed) Modified: user/ngie/stable-10-libnv/sys/kern/subr_nvpair.c ============================================================================== --- user/ngie/stable-10-libnv/sys/kern/subr_nvpair.c Sun Jan 3 07:30:12 2016 (r293080) +++ user/ngie/stable-10-libnv/sys/kern/subr_nvpair.c Sun Jan 3 07:37:46 2016 (r293081) @@ -734,7 +734,7 @@ nvpair_allocv(const char *name, int type if (nvp != NULL) { nvp->nvp_name = (char *)(nvp + 1); memcpy(nvp->nvp_name, name, namelen); - nvp->nvp_name[namelen + 1] = '\0'; + nvp->nvp_name[namelen] = '\0'; nvp->nvp_type = type; nvp->nvp_data = data; nvp->nvp_datasize = datasize; @@ -742,7 +742,7 @@ nvpair_allocv(const char *name, int type } return (nvp); -}; +} nvpair_t * nvpair_create_stringf(const char *name, const char *valuefmt, ...)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201601030737.u037blL5098354>