Re: mdconfig core dump

In message <[email protected]>, Giorgos Keramidas writes:
>Tonight, on a world compiled from last night's sources, mdconfig(8)
>started dumping cores for me.  The stack trace was:
>
>#0  0x080491da in strsep ()
>#1  0x08048961 in list (fd=3) at /usr/src/sbin/mdconfig/mdconfig.c:219
>#2  0x080487cc in main (argc=2, argv=0xbfbffaf0) at
>    /usr/src/sbin/mdconfig/mdconfig.c:176
>#3  0x08048139 in _start ()
>
>Does the following look a reasonable change?  It seems that strsep()
>starts getting angry when fed a non-nul-terminated buffer.

Absolutely.  Commit it.
>
>%%%
>Index: mdconfig.c
>===================================================================
>RCS file: /home/ncvs/src/sbin/mdconfig/mdconfig.c,v
>retrieving revision 1.23
>diff -u -r1.23 mdconfig.c
>--- mdconfig.c	21 Aug 2002 15:15:15 -0000	1.23
>+++ mdconfig.c	9 Oct 2002 22:01:19 -0000
>@@ -211,8 +211,9 @@
> 
> 	if (sysctlbyname("kern.disks", NULL, &dll, NULL, 0) == -1)
> 		err(1, "sysctlbyname: kern.disks");
>-	if ( (disklist = malloc(dll)) == NULL)
>+	if ( (disklist = malloc(dll + 1)) == NULL)
> 		err(1, "malloc");
>+	bzero(disklist, dll + 1);
> 	if (sysctlbyname("kern.disks", disklist, &dll, NULL, 0) == -1)
> 		err(1, "sysctlbyname: kern.disks");
> 
>%%%
>

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
[email protected]         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.

To Unsubscribe: send mail to [email protected]
with "unsubscribe freebsd-audit" in the body of the message