Date: Tue, 28 Apr 2009 20:39:22 +0000 (UTC) From: Ed Maste <emaste@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-6@freebsd.org Subject: svn commit: r191637 - stable/6/libexec/rtld-elf Message-ID: <200904282039.n3SKdMpl059365@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: emaste Date: Tue Apr 28 20:39:21 2009 New Revision: 191637 URL: http://svn.freebsd.org/changeset/base/191637 Log: MFC r155084: Fix a malloc overrun in 32-bit compat libmap lookup code. Modified: stable/6/libexec/rtld-elf/ (props changed) stable/6/libexec/rtld-elf/libmap.c Modified: stable/6/libexec/rtld-elf/libmap.c ============================================================================== --- stable/6/libexec/rtld-elf/libmap.c Tue Apr 28 20:36:07 2009 (r191636) +++ stable/6/libexec/rtld-elf/libmap.c Tue Apr 28 20:39:21 2009 (r191637) @@ -263,14 +263,12 @@ lm_findn (const char *p, const char *f, { char pathbuf[64], *s, *t; - if (n < sizeof(pathbuf) - 1) { - memcpy(pathbuf, f, n); - pathbuf[n] = '\0'; + if (n < sizeof(pathbuf) - 1) s = pathbuf; - } else { + else s = xmalloc(n + 1); - strcpy(s, f); - } + memcpy(s, f, n); + s[n] = '\0'; t = lm_find(p, s); if (s != pathbuf) free(s);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200904282039.n3SKdMpl059365>