Off-by-one error in ngets() causing panic in loader(8)?

Bruce Cran bruce at cran.org.uk
Mon Mar 30 14:23:15 PDT 2009


I've noticed that if I fill the input buffer at the loader prompt on
7-STABLE I get panic with a guard page failure.  From what I can see
the loader uses the ngets function in src/lib/libstand/gets.c with a
buffer of size of 256.  If I print out the value of strlen(input) in
interp.c I get 256. Shouldn't line 77 of gets.c be comparing (lp-buf)
against (n-1) instead of n?

-- 
Bruce Cran


More information about the freebsd-stable mailing list