Author: sbruno Date: Tue Apr 19 16:48:14 2016 New Revision: 298279 URL: https://svnweb.freebsd.org/changeset/base/298279
Log: Plug memory leak in ctl(4) when ctl_copyin_args() is called with a non- null terminated ASCII string. PR: 207626 Submitted by: ct...@hardenedbsd.org MFC after: 2 days Modified: head/sys/cam/ctl/ctl.c Modified: head/sys/cam/ctl/ctl.c ============================================================================== --- head/sys/cam/ctl/ctl.c Tue Apr 19 15:56:39 2016 (r298278) +++ head/sys/cam/ctl/ctl.c Tue Apr 19 16:48:14 2016 (r298279) @@ -2445,6 +2445,7 @@ ctl_copyin_args(int num_args, struct ctl && (tmpptr[args[i].vallen - 1] != '\0')) { snprintf(error_str, error_str_len, "Argument " "%d value is not NUL-terminated", i); + free(tmpptr, M_CTL); goto bailout; } args[i].kvalue = tmpptr; _______________________________________________ svn-src-head@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-head To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"