Date: Wed, 20 Jan 2016 19:08:49 +0000 (UTC) From: Brooks Davis <brooks@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r294453 - stable/10/lib/libc/string Message-ID: <201601201908.u0KJ8nD9078059@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: brooks Date: Wed Jan 20 19:08:49 2016 New Revision: 294453 URL: https://svnweb.freebsd.org/changeset/base/294453 Log: MFC r293855: Avoid reading pass the end of the source buffer when it is not NUL terminated. If this buffer is adjacent to an unmapped page or a version of C with bounds checked is used this may result in a crash. PR: 206177 Submitted by: Alexander Cherepanov <cherepan@mccme.ru> Modified: stable/10/lib/libc/string/wcsncat.c Directory Properties: stable/10/ (props changed) Modified: stable/10/lib/libc/string/wcsncat.c ============================================================================== --- stable/10/lib/libc/string/wcsncat.c Wed Jan 20 18:47:33 2016 (r294452) +++ stable/10/lib/libc/string/wcsncat.c Wed Jan 20 19:08:49 2016 (r294453) @@ -48,7 +48,7 @@ wcsncat(wchar_t * __restrict s1, const w p++; q = p; r = s2; - while (*r && n) { + while (n && *r) { *q++ = *r++; n--; }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201601201908.u0KJ8nD9078059>