Date: Mon, 16 May 2016 19:48:02 +0000 (UTC) From: Don Lewis <truckman@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r299971 - head/usr.bin/chat Message-ID: <201605161948.u4GJm2l5013275@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: truckman Date: Mon May 16 19:48:02 2016 New Revision: 299971 URL: https://svnweb.freebsd.org/changeset/base/299971 Log: Fix off by one error that overflowed the rep_len array when doing the final NUL termination. Reported by: Coverity CID: 1007617 MFC after: 1 week Modified: head/usr.bin/chat/chat.c Modified: head/usr.bin/chat/chat.c ============================================================================== --- head/usr.bin/chat/chat.c Mon May 16 19:42:38 2016 (r299970) +++ head/usr.bin/chat/chat.c Mon May 16 19:48:02 2016 (r299971) @@ -521,7 +521,7 @@ void terminate(int status) size_t rep_len; rep_len = strlen(report_buffer); - while (rep_len + 1 <= sizeof(report_buffer)) { + while (rep_len + 1 < sizeof(report_buffer)) { alarm(1); c = get_char(); alarm(0);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201605161948.u4GJm2l5013275>