Author: roberto Date: Sun Apr 19 23:34:52 2009 New Revision: 191298 URL: http://svn.freebsd.org/changeset/base/191298
Log: Prevent a buffer overflow in ntpq. Patch taken from the PR database after being committed to the official ntp tree and present in 4.2.4p7-rc2. It will be MFH to the upcoming 7.2 pending re approval. Obtained from: https://support.ntp.org/bugs/show_bug.cgi?id=1144 MFC after: 3 days Security: http://www.securityfocus.com/bid/34481 CVE-2009-0159 Modified: vendor/ntp/dist/ntpq/ntpq.c Modified: vendor/ntp/dist/ntpq/ntpq.c ============================================================================== --- vendor/ntp/dist/ntpq/ntpq.c Sun Apr 19 23:34:22 2009 (r191297) +++ vendor/ntp/dist/ntpq/ntpq.c Sun Apr 19 23:34:52 2009 (r191298) @@ -3185,9 +3185,9 @@ cookedprint( if (!decodeuint(value, &uval)) output_raw = '?'; else { - char b[10]; + char b[12]; - (void) sprintf(b, "%03lo", uval); + (void) snprintf(b, sizeof(b), "%03lo", uval); output(fp, name, b); } break; _______________________________________________ svn-src-all@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
