Fix a buffer overrun.
getln() returns 'len' valid characters. line[len] is out of bounds. Reported by: CHERI Reviewed by: brooks Obtained from: CheriBSD MFC after: 2 weeks Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D26197
This commit is contained in:
parent
2b33ffde2e
commit
ff38047b0c
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=365055
@ -76,15 +76,15 @@ load(const char *fname)
|
|||||||
if ((fp = fopen(fname, "r")) == NULL)
|
if ((fp = fopen(fname, "r")) == NULL)
|
||||||
ATF_REQUIRE(fp != NULL);
|
ATF_REQUIRE(fp != NULL);
|
||||||
while ((line = fgetln(fp, &len)) != NULL) {
|
while ((line = fgetln(fp, &len)) != NULL) {
|
||||||
char c = line[len];
|
char c = line[len - 1];
|
||||||
char *ptr;
|
char *ptr;
|
||||||
line[len] = '\0';
|
line[len - 1] = '\0';
|
||||||
for (ptr = strtok(line, WS); ptr; ptr = strtok(NULL, WS)) {
|
for (ptr = strtok(line, WS); ptr; ptr = strtok(NULL, WS)) {
|
||||||
if (ptr == '\0' || ptr[0] == '#')
|
if (ptr == '\0' || ptr[0] == '#')
|
||||||
continue;
|
continue;
|
||||||
sl_add(hosts, strdup(ptr));
|
sl_add(hosts, strdup(ptr));
|
||||||
}
|
}
|
||||||
line[len] = c;
|
line[len - 1] = c;
|
||||||
}
|
}
|
||||||
|
|
||||||
(void)fclose(fp);
|
(void)fclose(fp);
|
||||||
|
Loading…
Reference in New Issue
Block a user