buffer overflow in devclass_add_device()...

John Baldwin <[email protected]> Mon, 05 Aug 2002 08:45:07 -0400 (EDT)

Newsgroups	gmane.os.freebsd.devel.new-bus
Message-ID	<[email protected]>

Just in case you all didn't know this already, in the case of an
unwired device (dev->unit == -1) devclass_add_device() malloc's
a string assuming the unit count is 2 chars wide.  If we get a
unit >= 100, then we will overflow the buffer.  Probably we should
just malloc the nameunit buffer after we do the devclass_alloc_unit().

-- 

John Baldwin <[email protected]>  <><  http://www.FreeBSD.org/~jhb/
"Power Users Use the Power to Serve!"  -  http://www.FreeBSD.org/

To Unsubscribe: send mail to [email protected]
with "unsubscribe freebsd-new-bus" in the body of the message