diff options
| author | brooks <brooks@FreeBSD.org> | 2017-04-24 22:44:59 +0000 |
|---|---|---|
| committer | brooks <brooks@FreeBSD.org> | 2017-04-24 22:44:59 +0000 |
| commit | 46363633335040e5c23b3a216f5996e320867460 (patch) | |
| tree | 6d424016f4c436849509c175ccd507648b400a02 /lib | |
| parent | e8bb803babc5673a28555c9afa2a5f3da96add0f (diff) | |
| download | FreeBSD-src-46363633335040e5c23b3a216f5996e320867460.zip FreeBSD-src-46363633335040e5c23b3a216f5996e320867460.tar.gz | |
MFC r316768:
Fix an out-of-bounds write when a zero-length buffer is passed.
Found with ttyname_test and CHERI bounds checking.
Reviewed by: emaste
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/libc/gen/ttyname.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/lib/libc/gen/ttyname.c b/lib/libc/gen/ttyname.c index 02aa158..6628e3b 100644 --- a/lib/libc/gen/ttyname.c +++ b/lib/libc/gen/ttyname.c @@ -61,6 +61,10 @@ ttyname_r(int fd, char *buf, size_t len) { size_t used; + /* Don't write off the end of a zero-length buffer. */ + if (len < 1) + return (ERANGE); + *buf = '\0'; /* Must be a terminal. */ |
