Author: ngie
Date: Fri Jun 10 18:12:11 2016
New Revision: 301807
URL: https://svnweb.freebsd.org/changeset/base/301807
Log:
MFstable/10 r301806:
MFC r299510:
r299510 (by cem):
libmp: Fix trivial buffer overrun
fgetln yields a non-NUL-terminated buffer and its length. This routine
attempted to NUL-terminate it, but did not allocate space for the NUL. So,
allocate space for the NUL.
CID: 1017457
Modified:
stable/9/lib/libmp/mpasbn.c
Directory Properties:
stable/9/ (props changed)
stable/9/lib/ (props changed)
Modified: stable/9/lib/libmp/mpasbn.c
==============================================================================
--- stable/9/lib/libmp/mpasbn.c Fri Jun 10 18:10:32 2016 (r301806)
+++ stable/9/lib/libmp/mpasbn.c Fri Jun 10 18:12:11 2016 (r301807)
@@ -286,10 +286,10 @@ mp_min(MINT *mp)
line = fgetln(stdin, &linelen);
if (line == NULL)
MPERR(("min"));
- nline = malloc(linelen);
+ nline = malloc(linelen + 1);
if (nline == NULL)
MPERR(("min"));
- strncpy(nline, line, linelen);
+ memcpy(nline, line, linelen);
nline[linelen] = '\0';
rmp = _dtom("min", nline);
_movem("min", rmp, mp);
_______________________________________________
svn-src-stable-9@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-9
To unsubscribe, send any mail to "svn-src-stable-9-unsubscr...@freebsd.org"
