svn commit: r318293 - stable/11/sys/kern

[Ed Maste]

Author: emaste
Date: Mon May 15 14:41:47 2017
New Revision: 318293
URL: https://svnweb.freebsd.org/changeset/base/318293

Log:
  MFC r315685: tighten buffer bounds in imgact_binmisc_populate_interp
  
  We must ensure there's space for the terminating null in the temporary
  buffer in imgact_binmisc_populate_interp().
  
  Note that there's no buffer overflow here because xbe->xbe_interpreter's
  length and null termination is checked in imgact_binmisc_add_entry()
  before imgact_binmisc_populate_interp() is called. However, the latter
  should correctly enforce its own bounds.
  
  Sponsored by:	The FreeBSD Foundation

Modified:
  stable/11/sys/kern/imgact_binmisc.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/kern/imgact_binmisc.c
==============================================================================
--- stable/11/sys/kern/imgact_binmisc.c	Mon May 15 14:23:53 2017	(r318292)
+++ stable/11/sys/kern/imgact_binmisc.c	Mon May 15 14:41:47 2017	(r318293)
@@ -120,7 +120,7 @@ imgact_binmisc_populate_interp(char *str
 	sp = str; tp = t;
 	while (*sp != '\0') {
 		if (*sp == ' ' || *sp == '\t') {
-			if (++len > IBE_INTERP_LEN_MAX)
+			if (++len >= IBE_INTERP_LEN_MAX)
 				break;
 			*tp++ = ' ';
 			argc++;