d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a memory overflow where the input length to g_gpt_utf8_to_utf16()

Browse Source 
was specified incorrectly, causing the bzero to run past the end of a
malloc(9)'d object.

Submitted by:	Eric Youngblut < eyoungblut AT isilon DOT com >
MFC after:	3 days
This commit is contained in:
Matthew D Fleming 2011-01-07 16:46:20 +00:00
parent 8997563c9a
commit ed7beddc48
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/geom/part/g_part_gpt.c
View File

@ -425,7 +425,8 @@ g_part_gpt_add(struct g_part_table *basetable, struct g_part_entry *baseentry,
}
if (gpp->gpp_parms & G_PART_PARM_LABEL)
g_gpt_utf8_to_utf16(gpp->gpp_label, entry->ent.ent_name,
sizeof(entry->ent.ent_name));
sizeof(entry->ent.ent_name) /
sizeof(entry->ent.ent_name[0]));
return (0);
}
@ -588,7 +589,8 @@ g_part_gpt_modify(struct g_part_table *basetable,
}
if (gpp->gpp_parms & G_PART_PARM_LABEL)
g_gpt_utf8_to_utf16(gpp->gpp_label, entry->ent.ent_name,
sizeof(entry->ent.ent_name));
sizeof(entry->ent.ent_name) /
sizeof(entry->ent.ent_name[0]));
return (0);
}