bin/60026: [patch] Fix typo in malloc() size computation in
fdformat.c
Stefan Farfeleder
stefan at fafoe.narf.at
Sun Dec 7 14:00:46 PST 2003
>Number: 60026
>Category: bin
>Synopsis: [patch] Fix typo in malloc() size computation in fdformat.c
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sun Dec 07 14:00:37 PST 2003
>Closed-Date:
>Last-Modified:
>Originator: Stefan Farfeleder
>Release: FreeBSD 5.2-BETA i386
>Organization:
>Environment:
System: FreeBSD wombat.fafoe.narf.at 5.2-BETA FreeBSD 5.2-BETA #8: Sat Dec 6 18:47:24 CET 2003 stefan at wombat.fafoe.narf.at:/usr/home/stefan/freebsd/obj/usr/home/stefan/freebsd/src/sys/WOMBAT i386
>Description:
In fdformat.c a closing parenthesis is at the wrong place. Instead of
adding sizeof _PATH_DEV + 1 to the length of argv[optind], the length of the
string starting (sizeof _PATH_DEV + 1) characters after argv[optind]'s
beginning (accessing junk memory if we jump over the terminating null
character) is passed to malloc().
>How-To-Repeat:
n/a
>Fix:
--- fdformat.c.diff begins here ---
Index: src/usr.sbin/fdformat/fdformat.c
===================================================================
RCS file: /usr/home/ncvs/src/usr.sbin/fdformat/fdformat.c,v
retrieving revision 1.20
diff -u -r1.20 fdformat.c
--- src/usr.sbin/fdformat/fdformat.c 1 Apr 2002 21:13:17 -0000 1.20
+++ src/usr.sbin/fdformat/fdformat.c 19 Nov 2003 17:19:55 -0000
@@ -205,7 +205,7 @@
if (stat(argv[optind], &sb) == -1 && errno == ENOENT) {
/* try prepending _PATH_DEV */
- device = malloc(strlen(argv[optind] + sizeof _PATH_DEV + 1));
+ device = malloc(strlen(argv[optind]) + sizeof _PATH_DEV + 1);
if (device == 0)
errx(EX_UNAVAILABLE, "out of memory");
strcpy(device, _PATH_DEV);
--- fdformat.c.diff ends here ---
>Release-Note:
>Audit-Trail:
>Unformatted:
More information about the freebsd-bugs
mailing list