From owner-freebsd-bugs@FreeBSD.ORG Thu Nov 25 11:50:25 2004 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D75C416A4CF for ; Thu, 25 Nov 2004 11:50:25 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9A2E543D5C for ; Thu, 25 Nov 2004 11:50:25 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.1/8.13.1) with ESMTP id iAPBoPTC073538 for ; Thu, 25 Nov 2004 11:50:25 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.1/8.13.1/Submit) id iAPBoPrX073537; Thu, 25 Nov 2004 11:50:25 GMT (envelope-from gnats) Resent-Date: Thu, 25 Nov 2004 11:50:25 GMT Resent-Message-Id: <200411251150.iAPBoPrX073537@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Max Okumoto Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 65F5C16A4CE for ; Thu, 25 Nov 2004 11:43:03 +0000 (GMT) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id 53E3F43D66 for ; Thu, 25 Nov 2004 11:43:03 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id iAPBh3AR097795 for ; Thu, 25 Nov 2004 11:43:03 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id iAPBh33S097794; Thu, 25 Nov 2004 11:43:03 GMT (envelope-from nobody) Message-Id: <200411251143.iAPBh33S097794@www.freebsd.org> Date: Thu, 25 Nov 2004 11:43:03 GMT From: Max Okumoto To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-2.3 Subject: bin/74368: Bug in archive code (string is truncated) X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Nov 2004 11:50:26 -0000 >Number: 74368 >Category: bin >Synopsis: Bug in archive code (string is truncated) >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Nov 25 11:50:25 GMT 2004 >Closed-Date: >Last-Modified: >Originator: Max Okumoto >Release: 5.2.1 >Organization: Univ Calif San Diego >Environment: FreeBSD oecpc11.ucsd.edu 5.2.1-RELEASE-p12 FreeBSD 5.2.1-RELEASE-p12 #0: Thu Nov 25 01:31:26 PST 2004 root@oecpc11.ucsd.edu:/usr/obj/usr/src/sys/GENERIC i386 >Description: Date: 2004/11/14 20:13:12 Author: dillon Log: Fix an inverted conditional which could lead to nameBuf being truncated in the later snprintf(). Noticed-by: Max Okumoto Members: arch.c:1.11->1.12 >How-To-Repeat: >Fix: Apply patch. diff -ru fbsd-src/make/arch.c dfly-src/make/arch.c --- arch.c Mon Nov 15 20:39:53 2004 +++ arch.c Mon Nov 15 20:39:56 2004 @@ -341,15 +339,17 @@ char *member; size_t sz = MAXPATHLEN; size_t nsz; + nameBuf = emalloc(sz); Dir_Expand(memName, dirSearchPath, members); while (!Lst_IsEmpty(members)) { member = (char *)Lst_DeQueue(members); - nsz = strlen(libName) + strlen(member) + 3; - if (sz > nsz) - nameBuf = erealloc(nameBuf, sz = nsz * 2); - + nsz = strlen(libName) + strlen(member) + 3; /* 3 = ()+\0 */ + if (sz < nsz) { + sz = nsz * 2; + nameBuf = erealloc(nameBuf, sz); + } snprintf(nameBuf, sz, "%s(%s)", libName, member); free(member); gn = Targ_FindNode (nameBuf, TARG_CREATE); >Release-Note: >Audit-Trail: >Unformatted: