From owner-svn-src-all@FreeBSD.ORG Mon May 4 17:26:02 2009 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 41A8810656B9; Mon, 4 May 2009 17:26:01 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 55ADB8FC16; Mon, 4 May 2009 17:26:01 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id n44HQ1iU051600; Mon, 4 May 2009 17:26:01 GMT (envelope-from jhb@svn.freebsd.org) Received: (from jhb@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id n44HQ12l051599; Mon, 4 May 2009 17:26:01 GMT (envelope-from jhb@svn.freebsd.org) Message-Id: <200905041726.n44HQ12l051599@svn.freebsd.org> From: John Baldwin Date: Mon, 4 May 2009 17:26:01 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-6@freebsd.org X-SVN-Group: stable-6 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r191786 - stable/6/lib/libstand X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 May 2009 17:26:04 -0000 Author: jhb Date: Mon May 4 17:26:01 2009 New Revision: 191786 URL: http://svn.freebsd.org/changeset/base/191786 Log: MFC: Fix an off-by-one buffer overflow in ngets(). Modified: stable/6/lib/libstand/ (props changed) stable/6/lib/libstand/gets.c Modified: stable/6/lib/libstand/gets.c ============================================================================== --- stable/6/lib/libstand/gets.c Mon May 4 17:25:53 2009 (r191785) +++ stable/6/lib/libstand/gets.c Mon May 4 17:26:01 2009 (r191786) @@ -78,7 +78,7 @@ ngets(char *buf, int n) putchar('\n'); break; default: - if ((n < 1) || ((lp - buf) < n)) { + if ((n < 1) || ((lp - buf) < n - 1)) { *lp++ = c; putchar(c); }