svn commit: r316771 - head/sys/boot/common

[Conrad Meyer]

Author: cem
Date: Thu Apr 13 17:11:49 2017
New Revision: 316771
URL: https://svnweb.freebsd.org/changeset/base/316771

Log:
  loader: Avoid possible overflow via environment variable
  
  Reported by:	Coverity (CWE-120)
  CID:		1006704
  Sponsored by:	Dell EMC Isilon

Modified:
  head/sys/boot/common/commands.c

Modified: head/sys/boot/common/commands.c
==============================================================================
--- head/sys/boot/common/commands.c	Thu Apr 13 17:03:57 2017	(r316770)
+++ head/sys/boot/common/commands.c	Thu Apr 13 17:11:49 2017	(r316771)
@@ -132,7 +132,7 @@ command_help(int argc, char *argv[]) 
     char	*topic, *subtopic, *t, *s, *d;
 
     /* page the help text from our load path */
-    sprintf(buf, "%s/boot/loader.help", getenv("loaddev"));
+    snprintf(buf, sizeof(buf), "%s/boot/loader.help", getenv("loaddev"));
     if ((hfd = open(buf, O_RDONLY)) < 0) {
 	printf("Verbose help not available, use '?' to list commands\n");
 	return(CMD_OK);