diff options
| author | brooks <brooks@FreeBSD.org> | 2017-04-24 22:37:54 +0000 |
|---|---|---|
| committer | brooks <brooks@FreeBSD.org> | 2017-04-24 22:37:54 +0000 |
| commit | 40a67da9ff19d948efed9b50a548595322cc9e14 (patch) | |
| tree | d04d5cee23f5a1785d67ca3cf978fe49dcc26389 /lib/libc | |
| parent | b14e85d2ea3800b9e3e8978f553b877a5792918a (diff) | |
| download | FreeBSD-src-40a67da9ff19d948efed9b50a548595322cc9e14.zip FreeBSD-src-40a67da9ff19d948efed9b50a548595322cc9e14.tar.gz | |
MFC r316768:
Fix an out-of-bounds write when a zero-length buffer is passed.
Found with ttyname_test and CHERI bounds checking.
Reviewed by: emaste
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
Diffstat (limited to 'lib/libc')
| -rw-r--r-- | lib/libc/gen/ttyname.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/lib/libc/gen/ttyname.c b/lib/libc/gen/ttyname.c index 02aa158..6628e3b 100644 --- a/lib/libc/gen/ttyname.c +++ b/lib/libc/gen/ttyname.c @@ -61,6 +61,10 @@ ttyname_r(int fd, char *buf, size_t len) { size_t used; + /* Don't write off the end of a zero-length buffer. */ + if (len < 1) + return (ERANGE); + *buf = '\0'; /* Must be a terminal. */ |
