svn commit: r318293 - stable/11/sys/kern
Ed Maste
emaste at FreeBSD.org
Mon May 15 14:41:49 UTC 2017
Author: emaste
Date: Mon May 15 14:41:47 2017
New Revision: 318293
URL: https://svnweb.freebsd.org/changeset/base/318293
Log:
MFC r315685: tighten buffer bounds in imgact_binmisc_populate_interp
We must ensure there's space for the terminating null in the temporary
buffer in imgact_binmisc_populate_interp().
Note that there's no buffer overflow here because xbe->xbe_interpreter's
length and null termination is checked in imgact_binmisc_add_entry()
before imgact_binmisc_populate_interp() is called. However, the latter
should correctly enforce its own bounds.
Sponsored by: The FreeBSD Foundation
Modified:
stable/11/sys/kern/imgact_binmisc.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/kern/imgact_binmisc.c
==============================================================================
--- stable/11/sys/kern/imgact_binmisc.c Mon May 15 14:23:53 2017 (r318292)
+++ stable/11/sys/kern/imgact_binmisc.c Mon May 15 14:41:47 2017 (r318293)
@@ -120,7 +120,7 @@ imgact_binmisc_populate_interp(char *str
sp = str; tp = t;
while (*sp != '\0') {
if (*sp == ' ' || *sp == '\t') {
- if (++len > IBE_INTERP_LEN_MAX)
+ if (++len >= IBE_INTERP_LEN_MAX)
break;
*tp++ = ' ';
argc++;
More information about the svn-src-stable-11
mailing list