system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-09-16 06:52:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Compute the correct size of the string to move forward.

Browse source 
Previously this was counting the amount of spare room at the start of
the buffer that the string needed to move forward and passing that as
the number of bytes to copy to memmove rather than the length of the
string to be copied.

In the strfmon test in the test suite this caused the memmove to
overflow the allocated buffer by one byte which CHERI caught.

Reported by:	CHERI
Reviewed by:	kevans
Obtained from:	CheriBSD
MFC after:	1 week
Sponsored by:	DARPA
Differential Revision:	https://reviews.freebsd.org/D26280
This commit is contained in:
John Baldwin 2020-09-02 20:04:26 +00:00
parent a2d704d19f
commit 1a4531bc98
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=365276
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/libc/stdlib/strfmon.c
View file

@ -645,7 +645,7 @@ __format_grouped_double(double value, int *flags,
memset(bufend, pad_char, padded);
}
bufsize = bufsize - (bufend - rslt) + 1;
bufsize = rslt + bufsize - bufend;
memmove(rslt, bufend, bufsize);
free(avalue);
return (rslt);