Date: Fri, 12 Mar 2010 14:56:03 +0100 From: Oliver Pinter <oliver.pntr@gmail.com> To: Jaakko Heinonen <jh@freebsd.org> Cc: svn-src-stable@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org, svn-src-stable-8@freebsd.org Subject: Re: svn commit: r205070 - stable/8/lib/libc/stdio Message-ID: <6101e8c41003120556x64c73cfav9e2fc48c89de7490@mail.gmail.com> In-Reply-To: <201003120656.o2C6uqQD022867@svn.freebsd.org> References: <201003120656.o2C6uqQD022867@svn.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
this commit for 7-STABLE? On 3/12/10, Jaakko Heinonen <jh@freebsd.org> wrote: > Author: jh > Date: Fri Mar 12 06:56:51 2010 > New Revision: 205070 > URL: http://svn.freebsd.org/changeset/base/205070 > > Log: > MFC r204447: > > In _gettemp(), check that the length of the path doesn't exceed > MAXPATHLEN. Otherwise the path name (or part of it) may not fit to > carrybuf causing a buffer overflow. > > PR: bin/140228 > > Modified: > stable/8/lib/libc/stdio/mktemp.c > Directory Properties: > stable/8/lib/libc/ (props changed) > stable/8/lib/libc/stdtime/ (props changed) > > Modified: stable/8/lib/libc/stdio/mktemp.c > ============================================================================== > --- stable/8/lib/libc/stdio/mktemp.c Fri Mar 12 06:31:19 2010 (r205069) > +++ stable/8/lib/libc/stdio/mktemp.c Fri Mar 12 06:56:51 2010 (r205070) > @@ -116,6 +116,10 @@ _gettemp(path, doopen, domkdir, slen) > > for (trv = path; *trv != '\0'; ++trv) > ; > + if (trv - path >= MAXPATHLEN) { > + errno = ENAMETOOLONG; > + return (0); > + } > trv -= slen; > suffp = trv; > --trv; > _______________________________________________ > svn-src-stable@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/svn-src-stable > To unsubscribe, send any mail to "svn-src-stable-unsubscribe@freebsd.org" >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6101e8c41003120556x64c73cfav9e2fc48c89de7490>