svn commit: r306781 - stable/10/usr.bin/gcore

[John Baldwin]

Author: jhb
Date: Thu Oct  6 19:41:09 2016
New Revision: 306781
URL: https://svnweb.freebsd.org/changeset/base/306781

Log:
  MFC 299458: Fix buffer overrun in gcore(1) NT_PRPSINFO
  
  Use size of destination buffer, rather than a constant that may or may not
  correspond to the source buffer, to restrict the length of copied strings.  In
  particular, pr_fname has 16+1 characters but MAXCOMLEN is 18+1.
  
  Use strlcpy instead of strncpy to ensure the result is nul-terminated.  This
  seems to be what is expected of these fields.

Modified:
  stable/10/usr.bin/gcore/elfcore.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/usr.bin/gcore/elfcore.c
==============================================================================
--- stable/10/usr.bin/gcore/elfcore.c	Thu Oct  6 19:06:10 2016	(r306780)
+++ stable/10/usr.bin/gcore/elfcore.c	Thu Oct  6 19:41:09 2016	(r306781)
@@ -564,8 +564,8 @@ elf_note_prpsinfo(void *arg, size_t *siz
 		err(1, "kern.proc.pid.%u", pid);
 	if (kip.ki_pid != pid)
 		err(1, "kern.proc.pid.%u", pid);
-	strncpy(psinfo->pr_fname, kip.ki_comm, MAXCOMLEN);
-	strncpy(psinfo->pr_psargs, psinfo->pr_fname, PRARGSZ);
+	strlcpy(psinfo->pr_fname, kip.ki_comm, sizeof(psinfo->pr_fname));
+	strlcpy(psinfo->pr_psargs, psinfo->pr_fname, sizeof(psinfo->pr_psargs));
 
 	*sizep = sizeof(*psinfo);
 	return (psinfo);