Fix (static) buffer overflow bug. The dest buffer is of size MAXPATHLEN,
so dest[MAXPATHLEN] falls outside the buffer. This bug corrupted arenas[0] defined in libc's malloc.c on PowerPC when kldxref is shared, which triggered a delayed SIGSERV.
This commit is contained in:
parent
43bc7a9c62
commit
77a6f8ac6f
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=160982
@ -260,7 +260,7 @@ maketempfile(char *dest, const char *root)
|
||||
int fd;
|
||||
|
||||
strncpy(dest, root, MAXPATHLEN - 1);
|
||||
dest[MAXPATHLEN] = '\0';
|
||||
dest[MAXPATHLEN-1] = '\0';
|
||||
|
||||
if ((p = strrchr(dest, '/')) != 0)
|
||||
p++;
|
||||
|
Loading…
Reference in New Issue
Block a user