From owner-freebsd-current Thu Aug 8 01:02:13 1996 Return-Path: owner-current Received: (from root@localhost) by freefall.freebsd.org (8.7.5/8.7.3) id BAA19940 for current-outgoing; Thu, 8 Aug 1996 01:02:13 -0700 (PDT) Received: from irz301.inf.tu-dresden.de (irz301.inf.tu-dresden.de [141.76.1.11]) by freefall.freebsd.org (8.7.5/8.7.3) with SMTP id BAA19921 for ; Thu, 8 Aug 1996 01:01:57 -0700 (PDT) Received: from sax.sax.de (sax.sax.de [193.175.26.33]) by irz301.inf.tu-dresden.de (8.6.12/8.6.12-s1) with ESMTP id JAA10646; Thu, 8 Aug 1996 09:55:49 +0200 Received: (from uucp@localhost) by sax.sax.de (8.6.12/8.6.12-s1) with UUCP id JAA22318; Thu, 8 Aug 1996 09:55:49 +0200 Received: (from j@localhost) by uriah.heep.sax.de (8.7.5/8.6.9) id IAA16390; Thu, 8 Aug 1996 08:19:40 +0200 (MET DST) From: J Wunsch Message-Id: <199608080619.IAA16390@uriah.heep.sax.de> Subject: Re: exploitable security risk To: freebsd-current@FreeBSD.org (FreeBSD-current users) Date: Thu, 8 Aug 1996 08:19:40 +0200 (MET DST) Cc: marxx@doomsday.org (Charles C. Figueiredo) Reply-To: joerg_wunsch@uriah.heep.sax.de (Joerg Wunsch) In-Reply-To: from "Charles C. Figueiredo" at "Aug 7, 96 05:39:51 pm" X-Phone: +49-351-2012 669 X-PGP-Fingerprint: DC 47 E6 E4 FF A6 E9 8F 93 21 E0 7D F9 12 D6 4E X-Mailer: ELM [version 2.4ME+ PL17 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-current@FreeBSD.org X-Loop: FreeBSD.org Precedence: bulk As Charles C. Figueiredo wrote: > /usr/src/usr.bin/modstat/modstat.c does a blind strcpy from a char > pointer into a 32 byte buffer. [...] Thansk for pointing this out. However: > 48a49,50 > > #define MNLEN 32 > > > 75,76c77,78 > < if (modname != NULL) > < strcpy(sbuf.name, modname); > --- > > if ( modname != NULL) > > strncpy(sbuf.name, modname, MNLEN); . the name of the constant is MAXLKMNAME (now?) . the string should be '\0'-terminated even in case strncpy() trims it . a context diff would have been more appreciated ;) I'm going to commit a fix based on your suggestion, thanks! -- cheers, J"org joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ -- NIC: JW11-RIPE Never trust an operating system you don't have sources for. ;-)