Date: Wed, 22 May 2002 16:13:12 +1000 (EST) From: Mark Andrews <marka@isc.org> To: FreeBSD-gnats-submit@FreeBSD.org Subject: bin/38402: buffer underrun in mkstemp(). Message-ID: <200205220613.g4M6DCMY050936@drugs.dv.isc.org>
next in thread | raw e-mail | index | archive | help
>Number: 38402
>Category: bin
>Synopsis: buffer underrun in mkstemp().
>Confidential: no
>Severity: critical
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Tue May 21 23:20:01 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator: Mark Andrews
>Release: FreeBSD 4.6-RC i386
>Organization:
ISC
>Environment:
System: FreeBSD drugs.dv.isc.org 4.6-RC FreeBSD 4.6-RC #5: Sat May 18 12:54:10 EST 2002 marka@drugs.dv.isc.org:/usr/obj/usr/src/sys/DRUGS i386
>Description:
mkstemp() etc. will underrun the template buffer.
>How-To-Repeat:
main() {
int s; char buf1[30];
strcpy(buf1, "XXXXXXX");
s = mkstemp(buf1+2);
printf("%s\n", buf1);
}
The first two character should be X. You may need to repeat
depending upon the random characters selected.
>Fix:
Index: mktemp.c
===================================================================
RCS file: /home/ncvs/src/lib/libc/stdio/mktemp.c,v
retrieving revision 1.19.2.1
diff -u -r1.19.2.1 mktemp.c
--- mktemp.c 2001/01/20 09:35:24 1.19.2.1
+++ mktemp.c 2002/05/22 06:06:55
@@ -128,7 +128,7 @@
}
/* Fill space with random characters */
- while (*trv == 'X') {
+ while (*trv == 'X' && trv >= path) {
rand = arc4random() % (sizeof(padchar) - 1);
*trv-- = padchar[rand];
}
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200205220613.g4M6DCMY050936>