diff options
| author | gordon <gordon@FreeBSD.org> | 2018-05-08 17:14:54 +0000 |
|---|---|---|
| committer | gordon <gordon@FreeBSD.org> | 2018-05-08 17:14:54 +0000 |
| commit | 9d2807bdf72c932cabb0bf577328a5ba0eff42af (patch) | |
| tree | bc9d33b202825d3a66a1680abad21dc91f53d478 /sys/netinet | |
| parent | cbb1d33b29d7f60ebcbec4611e41b37b34fa25a5 (diff) | |
| download | FreeBSD-src-9d2807bdf72c932cabb0bf577328a5ba0eff42af.zip FreeBSD-src-9d2807bdf72c932cabb0bf577328a5ba0eff42af.tar.gz | |
Fix multiple small kernel memory disclosures. [EN-18:05.mem]
Approved by: so
Security: CVE-2018-6920
Security: CVE-2018-6921
Security: FreeBSD-EN-18:05.mem
Diffstat (limited to 'sys/netinet')
| -rw-r--r-- | sys/netinet/tcp_usrreq.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/netinet/tcp_usrreq.c b/sys/netinet/tcp_usrreq.c index 6a7bf00..64f8562 100644 --- a/sys/netinet/tcp_usrreq.c +++ b/sys/netinet/tcp_usrreq.c @@ -1495,7 +1495,9 @@ tcp_ctloutput(struct socket *so, struct sockopt *sopt) return (error); } else if ((sopt->sopt_dir == SOPT_GET) && (sopt->sopt_name == TCP_FUNCTION_BLK)) { - strcpy(fsn.function_set_name, tp->t_fb->tfb_tcp_block_name); + strncpy(fsn.function_set_name, tp->t_fb->tfb_tcp_block_name, + TCP_FUNCTION_NAME_LEN_MAX); + fsn.function_set_name[TCP_FUNCTION_NAME_LEN_MAX - 1] = '\0'; fsn.pcbcnt = tp->t_fb->tfb_refcnt; INP_WUNLOCK(inp); error = sooptcopyout(sopt, &fsn, sizeof fsn); |
