mirror of
https://git.FreeBSD.org/src.git
synced 2025-01-15 15:06:42 +00:00
0f23ab8aac
The bug is an out-of-bounds read detected with address sanitizer that happens when 'sp' in p_b_coll_elems() includes NUL byte[s], e.g. if it's equal to "GS\x00". In that case len will be equal to 4, and the strncmp(cp->name, sp, len) call will succeed when cp->name is "GS" but the cp->name[len] == '\0' comparison will cause the read to go out-of-bounds. Checking the length using strlen() instead eliminates the issue. The bug was found in LLVM with oss-fuzz: https://reviews.llvm.org/D39380 MFC after: 1 week Obtained from: Vlad Tsyrklevich through posting on openbsd-tech |
||
---|---|---|
.. | ||
aarch64 | ||
amd64 | ||
arm | ||
capability | ||
compat-43 | ||
db | ||
gdtoa | ||
gen | ||
gmon | ||
i386 | ||
iconv | ||
include | ||
inet | ||
isc | ||
locale | ||
md | ||
mips | ||
nameser | ||
net | ||
nls | ||
posix1e | ||
powerpc | ||
powerpc64 | ||
powerpcspe | ||
quad | ||
regex | ||
resolv | ||
riscv | ||
rpc | ||
secure | ||
softfloat | ||
sparc64 | ||
stdio | ||
stdlib | ||
stdtime | ||
string | ||
sys | ||
tests | ||
uuid | ||
x86/sys | ||
xdr | ||
yp | ||
libc_nossp.ldscript | ||
libc.ldscript | ||
Makefile | ||
Makefile.depend | ||
Versions.def |