Author: jhb Date: Wed Sep 2 20:04:26 2020 New Revision: 365276 URL: https://svnweb.freebsd.org/changeset/base/365276
Log: Compute the correct size of the string to move forward. Previously this was counting the amount of spare room at the start of the buffer that the string needed to move forward and passing that as the number of bytes to copy to memmove rather than the length of the string to be copied. In the strfmon test in the test suite this caused the memmove to overflow the allocated buffer by one byte which CHERI caught. Reported by: CHERI Reviewed by: kevans Obtained from: CheriBSD MFC after: 1 week Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D26280 Modified: head/lib/libc/stdlib/strfmon.c Modified: head/lib/libc/stdlib/strfmon.c ============================================================================== --- head/lib/libc/stdlib/strfmon.c Wed Sep 2 19:59:25 2020 (r365275) +++ head/lib/libc/stdlib/strfmon.c Wed Sep 2 20:04:26 2020 (r365276) @@ -645,7 +645,7 @@ __format_grouped_double(double value, int *flags, memset(bufend, pad_char, padded); } - bufsize = bufsize - (bufend - rslt) + 1; + bufsize = rslt + bufsize - bufend; memmove(rslt, bufend, bufsize); free(avalue); return (rslt); _______________________________________________ svn-src-head@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-head To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
