Date: Thu, 6 Oct 2016 19:41:09 +0000 (UTC) From: John Baldwin <jhb@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r306781 - stable/10/usr.bin/gcore Message-ID: <201610061941.u96Jf9gx038374@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: jhb Date: Thu Oct 6 19:41:09 2016 New Revision: 306781 URL: https://svnweb.freebsd.org/changeset/base/306781 Log: MFC 299458: Fix buffer overrun in gcore(1) NT_PRPSINFO Use size of destination buffer, rather than a constant that may or may not correspond to the source buffer, to restrict the length of copied strings. In particular, pr_fname has 16+1 characters but MAXCOMLEN is 18+1. Use strlcpy instead of strncpy to ensure the result is nul-terminated. This seems to be what is expected of these fields. Modified: stable/10/usr.bin/gcore/elfcore.c Directory Properties: stable/10/ (props changed) Modified: stable/10/usr.bin/gcore/elfcore.c ============================================================================== --- stable/10/usr.bin/gcore/elfcore.c Thu Oct 6 19:06:10 2016 (r306780) +++ stable/10/usr.bin/gcore/elfcore.c Thu Oct 6 19:41:09 2016 (r306781) @@ -564,8 +564,8 @@ elf_note_prpsinfo(void *arg, size_t *siz err(1, "kern.proc.pid.%u", pid); if (kip.ki_pid != pid) err(1, "kern.proc.pid.%u", pid); - strncpy(psinfo->pr_fname, kip.ki_comm, MAXCOMLEN); - strncpy(psinfo->pr_psargs, psinfo->pr_fname, PRARGSZ); + strlcpy(psinfo->pr_fname, kip.ki_comm, sizeof(psinfo->pr_fname)); + strlcpy(psinfo->pr_psargs, psinfo->pr_fname, sizeof(psinfo->pr_psargs)); *sizep = sizeof(*psinfo); return (psinfo);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201610061941.u96Jf9gx038374>