Date: Sat, 9 Feb 2019 14:21:30 +0000 (UTC) From: Stefan Esser <se@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org Subject: svn commit: r343939 - stable/12/libexec/getty Message-ID: <201902091421.x19ELUAd071260@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: se Date: Sat Feb 9 14:21:29 2019 New Revision: 343939 URL: https://svnweb.freebsd.org/changeset/base/343939 Log: MFC r343479: Fix potential buffer overflow and undefined behavior. The buffer allocated in read_chat() could be 1 element too short, if the chatstr parameter passed in is 1 or 3 charachters long (e.g. "a" or "a b"). The allocation of the pointer array does not account for the terminating NULL pointer in that case. Overlapping source and destination strings are undefined in strcpy(). Instead of moving a string to the left by one character just increment the char pointer before it is assigned to the results array. Modified: stable/12/libexec/getty/chat.c Modified: stable/12/libexec/getty/chat.c ============================================================================== --- stable/12/libexec/getty/chat.c Sat Feb 9 14:19:09 2019 (r343938) +++ stable/12/libexec/getty/chat.c Sat Feb 9 14:21:29 2019 (r343939) @@ -141,7 +141,7 @@ read_chat(char **chatstr) int l; if ((l=strlen(str)) > 0 && (tmp=malloc(l + 1)) != NULL && - (res=malloc((l / 2 + 1) * sizeof(char *))) != NULL) { + (res=malloc(((l + 1) / 2 + 1) * sizeof(char *))) != NULL) { static char ws[] = " \t"; char * p; @@ -216,7 +216,7 @@ read_chat(char **chatstr) q = strrchr(p+1, *p); if (q != NULL && *q == *p && q[1] == '\0') { *q = '\0'; - strcpy(p, p+1); + p++; } }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201902091421.x19ELUAd071260>