Off-by-one error in ngets() causing panic in loader(8)?
Bruce Cran
bruce at cran.org.uk
Mon Mar 30 14:23:15 PDT 2009
I've noticed that if I fill the input buffer at the loader prompt on
7-STABLE I get panic with a guard page failure. From what I can see
the loader uses the ngets function in src/lib/libstand/gets.c with a
buffer of size of 256. If I print out the value of strlen(input) in
interp.c I get 256. Shouldn't line 77 of gets.c be comparing (lp-buf)
against (n-1) instead of n?
--
Bruce Cran
More information about the freebsd-stable
mailing list