diff options
author | jhb <jhb@FreeBSD.org> | 2009-10-23 15:14:54 +0000 |
---|---|---|
committer | jhb <jhb@FreeBSD.org> | 2009-10-23 15:14:54 +0000 |
commit | a661f652ad42ad9b26c5a3ef8344be510bad0693 (patch) | |
tree | 57fba792ef7976f2978ea62c352da98e018bc872 /sys/kern/subr_bus.c | |
parent | 9414145b47d76b8115568171eea860c7f0b4988d (diff) | |
download | FreeBSD-src-a661f652ad42ad9b26c5a3ef8344be510bad0693.zip FreeBSD-src-a661f652ad42ad9b26c5a3ef8344be510bad0693.tar.gz |
- Fix several off-by-one errors when using MAXCOMLEN. The p_comm[] and
td_name[] arrays are actually MAXCOMLEN + 1 in size and a few places that
created shadow copies of these arrays were just using MAXCOMLEN.
- Prefer using sizeof() of an array type to explicit constants for the
array length in a few places.
- Ensure that all of p_comm[] and td_name[] is always zero'd during
execve() to guard against any possible information leaks. Previously
trailing garbage in p_comm[] could be leaked to userland in ktrace
record headers via td_name[].
Reviewed by: bde
Diffstat (limited to 'sys/kern/subr_bus.c')
-rw-r--r-- | sys/kern/subr_bus.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/kern/subr_bus.c b/sys/kern/subr_bus.c index 0c97aa3..0e3ef80 100644 --- a/sys/kern/subr_bus.c +++ b/sys/kern/subr_bus.c @@ -3861,8 +3861,8 @@ int bus_describe_intr(device_t dev, struct resource *irq, void *cookie, const char *fmt, ...) { - char descr[MAXCOMLEN]; va_list ap; + char descr[MAXCOMLEN + 1]; if (dev->parent == NULL) return (EINVAL); |