Author: cem
Date: Wed May 11 15:31:31 2016
New Revision: 299458
URL: https://svnweb.freebsd.org/changeset/base/299458
Log:
Fix buffer overrun in gcore(1) NT_PRPSINFO
Use size of destination buffer, rather than a constant that may or may not
correspond to the source buffer, to restrict the length of copied strings. In
particular, pr_fname has 16+1 characters but MAXCOMLEN is 18+1.
Use strlcpy instead of strncpy to ensure the result is nul-terminated. This
seems to be what is expected of these fields.
Reported by: Coverity
CIDs: 1011302, 1011378
Sponsored by: EMC / Isilon Storage Division
Modified:
head/usr.bin/gcore/elfcore.c
Modified: head/usr.bin/gcore/elfcore.c
==============================================================================
--- head/usr.bin/gcore/elfcore.c Wed May 11 14:59:54 2016
(r299457)
+++ head/usr.bin/gcore/elfcore.c Wed May 11 15:31:31 2016
(r299458)
@@ -560,8 +560,8 @@ elf_note_prpsinfo(void *arg, size_t *siz
err(1, "kern.proc.pid.%u", pid);
if (kip.ki_pid != pid)
err(1, "kern.proc.pid.%u", pid);
- strncpy(psinfo->pr_fname, kip.ki_comm, MAXCOMLEN);
- strncpy(psinfo->pr_psargs, psinfo->pr_fname, PRARGSZ);
+ strlcpy(psinfo->pr_fname, kip.ki_comm, sizeof(psinfo->pr_fname));
+ strlcpy(psinfo->pr_psargs, psinfo->pr_fname, sizeof(psinfo->pr_psargs));
*sizep = sizeof(*psinfo);
return (psinfo);
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
