Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 24 Apr 2017 22:37:54 +0000 (UTC)
From:      Brooks Davis <brooks@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org
Subject:   svn commit: r317391 - stable/11/lib/libc/gen
Message-ID:  <201704242237.v3OMbsbC012050@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: brooks
Date: Mon Apr 24 22:37:54 2017
New Revision: 317391
URL: https://svnweb.freebsd.org/changeset/base/317391

Log:
  MFC r316768:
  
  Fix an out-of-bounds write when a zero-length buffer is passed.
  
  Found with ttyname_test and CHERI bounds checking.
  
  Reviewed by:	emaste
  Obtained from:	CheriBSD
  Sponsored by:	DARPA, AFRL

Modified:
  stable/11/lib/libc/gen/ttyname.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/lib/libc/gen/ttyname.c
==============================================================================
--- stable/11/lib/libc/gen/ttyname.c	Mon Apr 24 22:35:00 2017	(r317390)
+++ stable/11/lib/libc/gen/ttyname.c	Mon Apr 24 22:37:54 2017	(r317391)
@@ -61,6 +61,10 @@ ttyname_r(int fd, char *buf, size_t len)
 {
 	size_t used;
 
+	/* Don't write off the end of a zero-length buffer. */
+	if (len < 1)
+		return (ERANGE);
+
 	*buf = '\0';
 
 	/* Must be a terminal. */



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201704242237.v3OMbsbC012050>