Date: Thu, 13 Apr 2017 17:11:50 +0000 (UTC) From: Conrad Meyer <cem@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r316771 - head/sys/boot/common Message-ID: <201704131711.v3DHBoOh039288@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: cem Date: Thu Apr 13 17:11:49 2017 New Revision: 316771 URL: https://svnweb.freebsd.org/changeset/base/316771 Log: loader: Avoid possible overflow via environment variable Reported by: Coverity (CWE-120) CID: 1006704 Sponsored by: Dell EMC Isilon Modified: head/sys/boot/common/commands.c Modified: head/sys/boot/common/commands.c ============================================================================== --- head/sys/boot/common/commands.c Thu Apr 13 17:03:57 2017 (r316770) +++ head/sys/boot/common/commands.c Thu Apr 13 17:11:49 2017 (r316771) @@ -132,7 +132,7 @@ command_help(int argc, char *argv[]) char *topic, *subtopic, *t, *s, *d; /* page the help text from our load path */ - sprintf(buf, "%s/boot/loader.help", getenv("loaddev")); + snprintf(buf, sizeof(buf), "%s/boot/loader.help", getenv("loaddev")); if ((hfd = open(buf, O_RDONLY)) < 0) { printf("Verbose help not available, use '?' to list commands\n"); return(CMD_OK);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201704131711.v3DHBoOh039288>