summaryrefslogtreecommitdiffstats
path: root/usr.sbin
diff options
context:
space:
mode:
authormarcel <marcel@FreeBSD.org>2006-08-04 21:28:42 +0000
committermarcel <marcel@FreeBSD.org>2006-08-04 21:28:42 +0000
commit5fae7020fe5406c283390c6b44394cc7be32fdd5 (patch)
treed2a482530f2ea65313d586e29ee2a4b7aae828dc /usr.sbin
parentbc6ab54808cf20a40cd7ba44043d40db1ec2e78e (diff)
downloadFreeBSD-src-5fae7020fe5406c283390c6b44394cc7be32fdd5.zip
FreeBSD-src-5fae7020fe5406c283390c6b44394cc7be32fdd5.tar.gz
Fix (static) buffer overflow bug. The dest buffer is of size MAXPATHLEN,
so dest[MAXPATHLEN] falls outside the buffer. This bug corrupted arenas[0] defined in libc's malloc.c on PowerPC when kldxref is shared, which triggered a delayed SIGSERV.
Diffstat (limited to 'usr.sbin')
-rw-r--r--usr.sbin/kldxref/kldxref.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/usr.sbin/kldxref/kldxref.c b/usr.sbin/kldxref/kldxref.c
index 4fa7c6d..40e364b 100644
--- a/usr.sbin/kldxref/kldxref.c
+++ b/usr.sbin/kldxref/kldxref.c
@@ -260,7 +260,7 @@ maketempfile(char *dest, const char *root)
int fd;
strncpy(dest, root, MAXPATHLEN - 1);
- dest[MAXPATHLEN] = '\0';
+ dest[MAXPATHLEN-1] = '\0';
if ((p = strrchr(dest, '/')) != 0)
p++;
OpenPOWER on IntegriCloud