svn commit: r299458 - head/usr.bin/gcore

[Conrad E. Meyer]

Author: cem
Date: Wed May 11 15:31:31 2016
New Revision: 299458
URL: https://svnweb.freebsd.org/changeset/base/299458

Log:
  Fix buffer overrun in gcore(1) NT_PRPSINFO
  
  Use size of destination buffer, rather than a constant that may or may not
  correspond to the source buffer, to restrict the length of copied strings.  In
  particular, pr_fname has 16+1 characters but MAXCOMLEN is 18+1.
  
  Use strlcpy instead of strncpy to ensure the result is nul-terminated.  This
  seems to be what is expected of these fields.
  
  Reported by:	Coverity
  CIDs:		1011302, 1011378
  Sponsored by:	EMC / Isilon Storage Division

Modified:
  head/usr.bin/gcore/elfcore.c

Modified: head/usr.bin/gcore/elfcore.c
==============================================================================
--- head/usr.bin/gcore/elfcore.c	Wed May 11 14:59:54 2016	(r299457)
+++ head/usr.bin/gcore/elfcore.c	Wed May 11 15:31:31 2016	(r299458)
@@ -560,8 +560,8 @@ elf_note_prpsinfo(void *arg, size_t *siz
 		err(1, "kern.proc.pid.%u", pid);
 	if (kip.ki_pid != pid)
 		err(1, "kern.proc.pid.%u", pid);
-	strncpy(psinfo->pr_fname, kip.ki_comm, MAXCOMLEN);
-	strncpy(psinfo->pr_psargs, psinfo->pr_fname, PRARGSZ);
+	strlcpy(psinfo->pr_fname, kip.ki_comm, sizeof(psinfo->pr_fname));
+	strlcpy(psinfo->pr_psargs, psinfo->pr_fname, sizeof(psinfo->pr_psargs));
 
 	*sizep = sizeof(*psinfo);
 	return (psinfo);