diff options
author | peter <peter@FreeBSD.org> | 2006-01-31 06:08:28 +0000 |
---|---|---|
committer | peter <peter@FreeBSD.org> | 2006-01-31 06:08:28 +0000 |
commit | 5d37faaea28c2d470d83b2ca5c09cbf863e0eaa7 (patch) | |
tree | b370b596b29140364f9d7aacf2f607a814acdb17 | |
parent | ad0b0bb8d9d19016e1eee6a112867daeeb372480 (diff) | |
download | FreeBSD-src-5d37faaea28c2d470d83b2ca5c09cbf863e0eaa7.zip FreeBSD-src-5d37faaea28c2d470d83b2ca5c09cbf863e0eaa7.tar.gz |
Fix a malloc overrun in 32-bit compat libmap lookup code.
-rw-r--r-- | libexec/rtld-elf/libmap.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/libexec/rtld-elf/libmap.c b/libexec/rtld-elf/libmap.c index cb72f03..773456b 100644 --- a/libexec/rtld-elf/libmap.c +++ b/libexec/rtld-elf/libmap.c @@ -263,14 +263,12 @@ lm_findn (const char *p, const char *f, const int n) { char pathbuf[64], *s, *t; - if (n < sizeof(pathbuf) - 1) { - memcpy(pathbuf, f, n); - pathbuf[n] = '\0'; + if (n < sizeof(pathbuf) - 1) s = pathbuf; - } else { + else s = xmalloc(n + 1); - strcpy(s, f); - } + memcpy(s, f, n); + s[n] = '\0'; t = lm_find(p, s); if (s != pathbuf) free(s); |