Page MenuHomeFreeBSD

h_resolv: Fix a buffer overflow in load().
ClosedPublic

Authored by jhb on Dec 27 2022, 10:25 PM.
Tags
None
Referenced Files
F109109075: D37886.diff
Fri, Jan 31, 10:00 PM
Unknown Object (File)
Sun, Jan 26, 11:26 PM
Unknown Object (File)
Sat, Jan 18, 8:18 AM
Unknown Object (File)
Fri, Jan 17, 3:11 PM
Unknown Object (File)
Dec 30 2024, 3:17 AM
Unknown Object (File)
Sep 27 2024, 1:46 AM
Unknown Object (File)
Sep 21 2024, 9:15 PM
Unknown Object (File)
Sep 18 2024, 1:00 AM
Subscribers

Details

Summary

fgetln() returns a pointer to an array of characters that is 'len'
characters long, not 'len + 1'. While here, overwriting the contents
of the buffer returned by fgetln isn't really safe, so switch to using
getline() instead.

Note that these fixes are a subset of those applied to a
near-identical copy of this function in libc's resolv_test.c in commit
2afeaad315ac19450389b8f2befdbe7c91c37818.

Reported by: CHERI (buffer overflow)

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 48895
Build 45784: arc lint + arc unit