Author: cem
Date: Thu May 12 03:53:20 2016
New Revision: 299510
URL: https://svnweb.freebsd.org/changeset/base/299510
Log:
libmp: Fix trivial buffer overrun
fgetln yields a non-NUL-terminated buffer and its length. This routine
attempted to NUL-terminate it, but did not allocate space for the NUL. So,
allocate space for the NUL.
Reported by: Coverity
CID: 1017457
Sponsored by: EMC / Isilon Storage Division
Modified:
head/lib/libmp/mpasbn.c
Modified: head/lib/libmp/mpasbn.c
==============================================================================
--- head/lib/libmp/mpasbn.c Thu May 12 03:49:05 2016 (r299509)
+++ head/lib/libmp/mpasbn.c Thu May 12 03:53:20 2016 (r299510)
@@ -286,10 +286,10 @@ mp_min(MINT *mp)
line = fgetln(stdin, &linelen);
if (line == NULL)
MPERR(("min"));
- nline = malloc(linelen);
+ nline = malloc(linelen + 1);
if (nline == NULL)
MPERR(("min"));
- strncpy(nline, line, linelen);
+ memcpy(nline, line, linelen);
nline[linelen] = '\0';
rmp = _dtom("min", nline);
_movem("min", rmp, mp);
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
