Date: Wed, 10 Dec 2014 08:24:03 +0000 (UTC) From: Xin LI <delphij@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r275667 - stable/10/lib/libc/stdio Message-ID: <201412100824.sBA8O3U6032981@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: delphij Date: Wed Dec 10 08:24:02 2014 New Revision: 275667 URL: https://svnweb.freebsd.org/changeset/base/275667 Log: MFC r275665: Fix buffer overflow in stdio. Security: FreeBSD-SA-14:27.stdio Security: CVE-2014-8611 Modified: stable/10/lib/libc/stdio/fflush.c Directory Properties: stable/10/ (props changed) Modified: stable/10/lib/libc/stdio/fflush.c ============================================================================== --- stable/10/lib/libc/stdio/fflush.c Wed Dec 10 08:19:55 2014 (r275666) +++ stable/10/lib/libc/stdio/fflush.c Wed Dec 10 08:24:02 2014 (r275667) @@ -124,11 +124,13 @@ __sflush(FILE *fp) t = _swrite(fp, (char *)p, n); if (t <= 0) { /* Reset _p and _w. */ - if (p > fp->_p) /* Some was written. */ + if (p > fp->_p) { + /* Some was written. */ memmove(fp->_p, p, n); - fp->_p += n; - if ((fp->_flags & (__SLBF | __SNBF)) == 0) - fp->_w -= n; + fp->_p += n; + if ((fp->_flags & (__SLBF | __SNBF)) == 0) + fp->_w -= n; + } fp->_flags |= __SERR; return (EOF); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201412100824.sBA8O3U6032981>