CVSROOT: /cvs
Module name: src
Changes by: mes...@cvs.openbsd.org 2018/08/23 00:27:54
Modified files:
usr.sbin/ac : ac.c
Log message:
We can safely assume that our utmp(5) file format implementation can guarantee
space for the NUL character, nevertheless there will always be some piece of
software that can get it wrong and corrupt the database, so we must take this
into consideration.
That being said, there is one strlcpy(3) that needs to be reverted back into
strncpy(3) + '\0' since if we try to use a bogus wtmp(5) file with ac(8) that
is big enough then the NUL char is not verified and it will write memory
out-of-bounds which will make the program crash.
discussed with and OK cheloha@ deraadt@
