From owner-svn-src-all@FreeBSD.ORG Wed Dec 10 08:18:23 2014 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 5DFBC4B7; Wed, 10 Dec 2014 08:18:23 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4AF196CE; Wed, 10 Dec 2014 08:18:23 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id sBA8INs0028610; Wed, 10 Dec 2014 08:18:23 GMT (envelope-from delphij@FreeBSD.org) Received: (from delphij@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id sBA8INOQ028609; Wed, 10 Dec 2014 08:18:23 GMT (envelope-from delphij@FreeBSD.org) Message-Id: <201412100818.sBA8INOQ028609@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: delphij set sender to delphij@FreeBSD.org using -f From: Xin LI Date: Wed, 10 Dec 2014 08:18:23 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r275665 - head/lib/libc/stdio X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Dec 2014 08:18:23 -0000 Author: delphij Date: Wed Dec 10 08:18:22 2014 New Revision: 275665 URL: https://svnweb.freebsd.org/changeset/base/275665 Log: In r268924 __fflush was modified so that when write(2) was not successful, _p and _w are adjusted to account for the partial write (if any). However, _p and _w should not be unconditionally adjusted and should only be changed when we actually wrote some bytes, or the accumulated accounting error will eventually result in a heap buffer overflow. Reported by: adrian and alfred (Norse Corporation) Security: FreeBSD-SA-14:27.stdio Security: CVE-2014-8611 Modified: head/lib/libc/stdio/fflush.c Modified: head/lib/libc/stdio/fflush.c ============================================================================== --- head/lib/libc/stdio/fflush.c Wed Dec 10 06:43:16 2014 (r275664) +++ head/lib/libc/stdio/fflush.c Wed Dec 10 08:18:22 2014 (r275665) @@ -124,11 +124,13 @@ __sflush(FILE *fp) t = _swrite(fp, (char *)p, n); if (t <= 0) { /* Reset _p and _w. */ - if (p > fp->_p) /* Some was written. */ + if (p > fp->_p) { + /* Some was written. */ memmove(fp->_p, p, n); - fp->_p += n; - if ((fp->_flags & (__SLBF | __SNBF)) == 0) - fp->_w -= n; + fp->_p += n; + if ((fp->_flags & (__SLBF | __SNBF)) == 0) + fp->_w -= n; + } fp->_flags |= __SERR; return (EOF); }