mirror of
https://github.com/freebsd/freebsd-src
synced 2024-09-06 17:18:32 +00:00
From PR:
In fdformat.c a closing parenthesis is at the wrong place. Instead of adding sizeof _PATH_DEV + 1 to the length of argv[optind], the length of the string starting (sizeof _PATH_DEV + 1) characters after argv[optind]'s beginning (accessing junk memory if we jump over the terminating null character) is passed to malloc(). PR: bin/60026 Submitted by: Stefan Farfeleder <stefan@fafoe.narf.at>
This commit is contained in:
parent
dba7bc6a65
commit
624a58b6e6
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=124200
|
@ -205,7 +205,7 @@ main(int argc, char **argv)
|
|||
|
||||
if (stat(argv[optind], &sb) == -1 && errno == ENOENT) {
|
||||
/* try prepending _PATH_DEV */
|
||||
device = malloc(strlen(argv[optind] + sizeof _PATH_DEV + 1));
|
||||
device = malloc(strlen(argv[optind]) + sizeof(_PATH_DEV) + 1);
|
||||
if (device == 0)
|
||||
errx(EX_UNAVAILABLE, "out of memory");
|
||||
strcpy(device, _PATH_DEV);
|
||||
|
|
Loading…
Reference in a new issue