https://sourceware.org/git/gitweb.cgi?p=newlib-cygwin.git;h=1adbd77cab6f60b105c5d8b1a4350161c3ac213d
commit 1adbd77cab6f60b105c5d8b1a4350161c3ac213d Author: Michael Haubenwallner <michael.haubenwall...@ssi-schaefer.com> Date: Mon Oct 9 18:58:24 2017 +0200 cygwin: fix potential buffer overflow in fork When fork fails, we can use "%s" now with system_sprintf for the errmsg rather than a (potentially too small) buffer for the format string. * fork.cc (fork): Use "%s" with system_printf now. Diff: --- winsup/cygwin/fork.cc | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/winsup/cygwin/fork.cc b/winsup/cygwin/fork.cc index 73a72f5..bcbef12 100644 --- a/winsup/cygwin/fork.cc +++ b/winsup/cygwin/fork.cc @@ -618,13 +618,8 @@ fork () if (!grouped.errmsg) syscall_printf ("fork failed - child pid %d, errno %d", grouped.child_pid, grouped.this_errno); else - { - char buf[strlen (grouped.errmsg) + sizeof ("child %d - , errno 4294967295 ")]; - strcpy (buf, "child %d - "); - strcat (buf, grouped.errmsg); - strcat (buf, ", errno %d"); - system_printf (buf, grouped.child_pid, grouped.this_errno); - } + system_printf ("child %d - %s, errno %d", grouped.child_pid, + grouped.errmsg, grouped.this_errno); set_errno (grouped.this_errno); }