Author: ngie
Date: Fri Jun 10 18:10:32 2016
New Revision: 301806
URL: https://svnweb.freebsd.org/changeset/base/301806
Log:
MFC r299510:
r299510 (by cem):
libmp: Fix trivial buffer overrun
fgetln yields a non-NUL-terminated buffer and its length. This routine
attempted to NUL-terminate it, but did not allocate space for the NUL. So,
allocate space for the NUL.
CID: 1017457
Modified:
stable/10/lib/libmp/mpasbn.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/lib/libmp/mpasbn.c
==============================================================================
--- stable/10/lib/libmp/mpasbn.c Fri Jun 10 18:07:35 2016
(r301805)
+++ stable/10/lib/libmp/mpasbn.c Fri Jun 10 18:10:32 2016
(r301806)
@@ -286,10 +286,10 @@ mp_min(MINT *mp)
line = fgetln(stdin, &linelen);
if (line == NULL)
MPERR(("min"));
- nline = malloc(linelen);
+ nline = malloc(linelen + 1);
if (nline == NULL)
MPERR(("min"));
- strncpy(nline, line, linelen);
+ memcpy(nline, line, linelen);
nline[linelen] = '\0';
rmp = _dtom("min", nline);
_movem("min", rmp, mp);
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
