tighten buffer bounds in imgact_binmisc_populate_interp
We must ensure there's space for the terminating null in the temporary buffer in imgact_binmisc_populate_interp(). Note that there's no buffer overflow here because xbe->xbe_interpreter's length and null termination is checked in imgact_binmisc_add_entry() before imgact_binmisc_populate_interp() is called. However, the latter should correctly enforce its own bounds. Reviewed by: sbruno MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D10042
This commit is contained in:
parent
3ae4b0e7e8
commit
26af611582
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=315685
@ -120,7 +120,7 @@ imgact_binmisc_populate_interp(char *str, imgact_binmisc_entry_t *ibe)
|
||||
sp = str; tp = t;
|
||||
while (*sp != '\0') {
|
||||
if (*sp == ' ' || *sp == '\t') {
|
||||
if (++len > IBE_INTERP_LEN_MAX)
|
||||
if (++len >= IBE_INTERP_LEN_MAX)
|
||||
break;
|
||||
*tp++ = ' ';
|
||||
argc++;
|
||||
|
Loading…
Reference in New Issue
Block a user