From owner-svn-src-stable@freebsd.org Wed Jun 1 22:39:16 2016 Return-Path: Delivered-To: svn-src-stable@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id A4DC0B66A95; Wed, 1 Jun 2016 22:39:16 +0000 (UTC) (envelope-from truckman@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 7134F1E46; Wed, 1 Jun 2016 22:39:16 +0000 (UTC) (envelope-from truckman@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u51MdFSe067951; Wed, 1 Jun 2016 22:39:15 GMT (envelope-from truckman@FreeBSD.org) Received: (from truckman@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u51MdF9A067950; Wed, 1 Jun 2016 22:39:15 GMT (envelope-from truckman@FreeBSD.org) Message-Id: <201606012239.u51MdF9A067950@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: truckman set sender to truckman@FreeBSD.org using -f From: Don Lewis Date: Wed, 1 Jun 2016 22:39:15 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r301178 - stable/10/games/fortune/unstr X-SVN-Group: stable-10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: SVN commit messages for all the -stable branches of the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jun 2016 22:39:16 -0000 Author: truckman Date: Wed Jun 1 22:39:15 2016 New Revision: 301178 URL: https://svnweb.freebsd.org/changeset/base/301178 Log: MFC r300705 (compensating for fortune moving from games to usr.bin) Avoid buffer overflow when copying the input file name and appending .dat. Check the return value from fread() to be sure that it was successful. Reported by: Coverity CID: 1006709, 1009452 Modified: stable/10/games/fortune/unstr/unstr.c Directory Properties: stable/10/ (props changed) Modified: stable/10/games/fortune/unstr/unstr.c ============================================================================== --- stable/10/games/fortune/unstr/unstr.c Wed Jun 1 22:34:21 2016 (r301177) +++ stable/10/games/fortune/unstr/unstr.c Wed Jun 1 22:39:15 2016 (r301178) @@ -86,13 +86,19 @@ main(int argc, char *argv[]) exit(1); } Infile = argv[1]; - strcpy(Datafile, Infile); - strcat(Datafile, ".dat"); + if ((size_t)snprintf(Datafile, sizeof(Datafile), "%s.dat", Infile) >= + sizeof(Datafile)) + errx(1, "%s name too long", Infile); if ((Inf = fopen(Infile, "r")) == NULL) err(1, "%s", Infile); if ((Dataf = fopen(Datafile, "r")) == NULL) err(1, "%s", Datafile); - fread((char *)&tbl, sizeof(tbl), 1, Dataf); + if (fread((char *)&tbl, sizeof(tbl), 1, Dataf) != 1) { + if (feof(Dataf)) + errx(1, "%s read EOF", Datafile); + else + err(1, "%s read", Datafile); + } tbl.str_version = be32toh(tbl.str_version); tbl.str_numstr = be32toh(tbl.str_numstr); tbl.str_longlen = be32toh(tbl.str_longlen);