Date: Mon, 30 Mar 2009 22:23:07 +0100 From: Bruce Cran <bruce@cran.org.uk> To: freebsd-stable@freebsd.org Subject: Off-by-one error in ngets() causing panic in loader(8)? Message-ID: <20090330222307.25181df6@gluon.draftnet>
next in thread | raw e-mail | index | archive | help
I've noticed that if I fill the input buffer at the loader prompt on 7-STABLE I get panic with a guard page failure. From what I can see the loader uses the ngets function in src/lib/libstand/gets.c with a buffer of size of 256. If I print out the value of strlen(input) in interp.c I get 256. Shouldn't line 77 of gets.c be comparing (lp-buf) against (n-1) instead of n? -- Bruce Cran
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090330222307.25181df6>