Date: Tue, 30 Oct 2001 04:03:11 -0800 (PST) From: Daniel McRobb <dwm@caimis.com> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/31637: linux_getcwd() bogus buffer length check Message-ID: <200110301203.f9UC3BQ53402@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 31637
>Category: kern
>Synopsis: linux_getcwd() bogus buffer length check
>Confidential: no
>Severity: non-critical
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Tue Oct 30 04:10:01 PST 2001
>Closed-Date:
>Last-Modified:
>Originator: Daniel McRobb
>Release: 4.4-STABLE Oct. 30, 2001
>Organization:
Caimis
>Environment:
FreeBSD morgaine.caimis.com 4.4-STABLE FreeBSD 4.4-STABLE #2: Tue Oct 30 06:24:17 EST 2001 dwm@morgaine.caimis.com:/usr/src/sys/compile/morgaine i386
>Description:
len (uninitialized) is checked when lenused should be checked
>How-To-Repeat:
run opera, try to save to a file...
>Fix:
% diff linux_getcwd.c linux_getcwd.c.fixed
429c429
< if (len <= args->bufsize) {
---
> if (lenused <= args->bufsize) {
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200110301203.f9UC3BQ53402>