diff options
| author | davidxu <davidxu@FreeBSD.org> | 2005-09-26 14:14:55 +0000 |
|---|---|---|
| committer | davidxu <davidxu@FreeBSD.org> | 2005-09-26 14:14:55 +0000 |
| commit | fa2166ed096c5a0b93c367dfeccb31524698332e (patch) | |
| tree | 42fdff0be28e0601ed5294e7fb010f9ba9d49064 /sys/kern/kern_environment.c | |
| parent | 953bbe6a0d33d14c029fac2c7ebea7660135c21f (diff) | |
| download | FreeBSD-src-fa2166ed096c5a0b93c367dfeccb31524698332e.zip FreeBSD-src-fa2166ed096c5a0b93c367dfeccb31524698332e.tar.gz | |
Reorder statements to avoid accessing unknown memory.
In theory, invoking kenv with very long string can panic
kernel.
Diffstat (limited to 'sys/kern/kern_environment.c')
| -rw-r--r-- | sys/kern/kern_environment.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/kern/kern_environment.c b/sys/kern/kern_environment.c index 4fd84ae..9bb8814 100644 --- a/sys/kern/kern_environment.c +++ b/sys/kern/kern_environment.c @@ -240,8 +240,8 @@ _getenv_dynamic(const char *name, int *idx) sx_assert(&kenv_lock, SX_LOCKED); len = strlen(name); for (cp = kenvp[0], i = 0; cp != NULL; cp = kenvp[++i]) { - if ((cp[len] == '=') && - (strncmp(cp, name, len) == 0)) { + if ((strncmp(cp, name, len) == 0) && + (cp[len] == '=')) { if (idx != NULL) *idx = i; return (cp + len + 1); |
