Date: Fri, 6 May 2016 19:11:48 +0000 (UTC) From: Sean Bruno <sbruno@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r299191 - stable/10/sys/cam/ctl Message-ID: <201605061911.u46JBmHB075259@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: sbruno Date: Fri May 6 19:11:47 2016 New Revision: 299191 URL: https://svnweb.freebsd.org/changeset/base/299191 Log: MFC r298279 Plug memory leak in ctl(4) when ctl_copyin_args() is called with a non- null terminated ASCII string. PR: 207626 Submitted by: cturt@hardenedbsd.org Modified: stable/10/sys/cam/ctl/ctl.c Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/cam/ctl/ctl.c ============================================================================== --- stable/10/sys/cam/ctl/ctl.c Fri May 6 17:55:11 2016 (r299190) +++ stable/10/sys/cam/ctl/ctl.c Fri May 6 19:11:47 2016 (r299191) @@ -2447,6 +2447,7 @@ ctl_copyin_args(int num_args, struct ctl && (tmpptr[args[i].vallen - 1] != '\0')) { snprintf(error_str, error_str_len, "Argument " "%d value is not NUL-terminated", i); + free(tmpptr, M_CTL); goto bailout; } args[i].kvalue = tmpptr;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201605061911.u46JBmHB075259>