d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix bad libbxo format strings in jls

Browse Source 
The existing format string for the empty case was trying to read varargs
values that weren't passed to xo_emit. This appears to work on x86 (since
the next argument is probably a pointer an empty string), but for CHERI
we can bound variadic arguments and detect a read past the end.

While touching these lines also use the libxo 'a' modifier to avoid having to
construct the libxo format string using asprintf.

Found by:	CHERI
Reviewed By:	allanjude
Differential Revision: https://reviews.freebsd.org/D26885
This commit is contained in:
Alex Richardson 2020-11-04 14:31:52 +00:00
parent 4c18532bd0
commit d24f17df96
1 changed files with 2 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
usr.sbin/jls/jls.c
View File

@ -505,17 +505,13 @@ quoted_print(int pflags, char *name, char *value)
{
int qc;
char *p = value;
char *param_name_value;
/* An empty string needs quoting. */
if (!*p) {
asprintf(&param_name_value, "{k:%s}{d:%s/\"\"}", name, name);
xo_emit(param_name_value);
free(param_name_value);
xo_emit("{ea:/%s}{da:/\"\"}", name, value, name);
return;
}
asprintf(&param_name_value, "{:%s/%%s}", name);
/*
* The value will be surrounded by quotes if it contains spaces
* or quotes.
@ -528,9 +524,7 @@ quoted_print(int pflags, char *name, char *value)
if (qc && pflags & PRINT_QUOTED)
xo_emit("{P:/%c}", qc);
xo_emit(param_name_value, value);
free(param_name_value);
xo_emit("{a:/%s}", name, value);
if (qc && pflags & PRINT_QUOTED)
xo_emit("{P:/%c}", qc);