Author: truckman Date: Mon May 16 19:48:02 2016 New Revision: 299971 URL: https://svnweb.freebsd.org/changeset/base/299971
Log: Fix off by one error that overflowed the rep_len array when doing the final NUL termination. Reported by: Coverity CID: 1007617 MFC after: 1 week Modified: head/usr.bin/chat/chat.c Modified: head/usr.bin/chat/chat.c ============================================================================== --- head/usr.bin/chat/chat.c Mon May 16 19:42:38 2016 (r299970) +++ head/usr.bin/chat/chat.c Mon May 16 19:48:02 2016 (r299971) @@ -521,7 +521,7 @@ void terminate(int status) size_t rep_len; rep_len = strlen(report_buffer); - while (rep_len + 1 <= sizeof(report_buffer)) { + while (rep_len + 1 < sizeof(report_buffer)) { alarm(1); c = get_char(); alarm(0); _______________________________________________ svn-src-head@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-head To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"