Date: Mon, 23 May 2016 05:25:29 +0000 (UTC) From: Don Lewis <truckman@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r300461 - stable/10/usr.bin/chat Message-ID: <201605230525.u4N5PTvX087839@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: truckman Date: Mon May 23 05:25:29 2016 New Revision: 300461 URL: https://svnweb.freebsd.org/changeset/base/300461 Log: MFC r299971 Fix off by one error that overflowed the rep_len array when doing the final NUL termination. Reported by: Coverity CID: 1007617 Modified: stable/10/usr.bin/chat/chat.c Directory Properties: stable/10/ (props changed) Modified: stable/10/usr.bin/chat/chat.c ============================================================================== --- stable/10/usr.bin/chat/chat.c Mon May 23 05:23:53 2016 (r300460) +++ stable/10/usr.bin/chat/chat.c Mon May 23 05:25:29 2016 (r300461) @@ -521,7 +521,7 @@ void terminate(int status) size_t rep_len; rep_len = strlen(report_buffer); - while (rep_len + 1 <= sizeof(report_buffer)) { + while (rep_len + 1 < sizeof(report_buffer)) { alarm(1); c = get_char(); alarm(0);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201605230525.u4N5PTvX087839>