CVS: cvs.openbsd.org: src
Greg Steuck <[email protected]>
| Newsgroups | gmane.os.openbsd.cvs |
|---|---|
| Message-ID | <[email protected]> |
CVSROOT: /cvs Module name: src Changes by: [email protected] 2026/06/26 04:32:32 Modified files: sys/dev/usb : ucom.c Log message: ucom: fix OOB write in sysctl_ucominit with no ucom devices cd_ndevs==0 makes ucomslen 0, so malloc(0) returns unzeroed storage (M_ZERO memsets osize==0 bytes). strlen(ucoms) then walks garbage and ucoms[strlen-1]=0 stores out of bounds (KASAN: __asan_store1, hw.ucomnames). Size the buffer for one extra slot so it is never zero-sized. KASAN#2, with a murmur of agreement in the hackroom