In dt_cc.c when the provider is an empty string, accessing strlen(pdp->dtpd_provider) - 1 will result in a pdp->dtpd_provider[-1] access. Similarly, in dt_ident.c, if p2 is a NULL pointer, doing a p2++ on it is undefined behaviour. Reviewed by: markj MFC after: 1 week Sponsored by: Google Differential Revision: https://reviews.freebsd.org/D30778 |
||
---|---|---|
.. | ||
opensolaris |