diff options
| author | jhb <jhb@FreeBSD.org> | 2016-10-06 19:41:09 +0000 |
|---|---|---|
| committer | jhb <jhb@FreeBSD.org> | 2016-10-06 19:41:09 +0000 |
| commit | ae1958d197960436ece49a118519c2722ec64aaf (patch) | |
| tree | 3f0670c20ae21b3e6b95a1bed9f7f1728843e96c | |
| parent | dd4e81eb7d7d66d675f6554e6d582dbc9288cb6d (diff) | |
| download | FreeBSD-src-ae1958d197960436ece49a118519c2722ec64aaf.zip FreeBSD-src-ae1958d197960436ece49a118519c2722ec64aaf.tar.gz | |
MFC 299458: Fix buffer overrun in gcore(1) NT_PRPSINFO
Use size of destination buffer, rather than a constant that may or may not
correspond to the source buffer, to restrict the length of copied strings. In
particular, pr_fname has 16+1 characters but MAXCOMLEN is 18+1.
Use strlcpy instead of strncpy to ensure the result is nul-terminated. This
seems to be what is expected of these fields.
| -rw-r--r-- | usr.bin/gcore/elfcore.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/usr.bin/gcore/elfcore.c b/usr.bin/gcore/elfcore.c index ad7f052..24b2a2b 100644 --- a/usr.bin/gcore/elfcore.c +++ b/usr.bin/gcore/elfcore.c @@ -564,8 +564,8 @@ elf_note_prpsinfo(void *arg, size_t *sizep) err(1, "kern.proc.pid.%u", pid); if (kip.ki_pid != pid) err(1, "kern.proc.pid.%u", pid); - strncpy(psinfo->pr_fname, kip.ki_comm, MAXCOMLEN); - strncpy(psinfo->pr_psargs, psinfo->pr_fname, PRARGSZ); + strlcpy(psinfo->pr_fname, kip.ki_comm, sizeof(psinfo->pr_fname)); + strlcpy(psinfo->pr_psargs, psinfo->pr_fname, sizeof(psinfo->pr_psargs)); *sizep = sizeof(*psinfo); return (psinfo); |
