Page MenuHomeFreeBSD

quot: Fix benign buffer overflow
ClosedPublic

Authored by des on Oct 16 2025, 10:32 AM.
Tags
None
Referenced Files
F157230629: D53129.diff
Tue, May 19, 12:57 PM
Unknown Object (File)
Thu, May 14, 2:01 PM
Unknown Object (File)
Thu, May 14, 8:25 AM
Unknown Object (File)
Wed, May 13, 6:33 AM
Unknown Object (File)
Tue, May 5, 9:12 AM
Unknown Object (File)
Sat, May 2, 7:53 PM
Unknown Object (File)
Mon, Apr 20, 12:23 PM
Unknown Object (File)
Mon, Apr 20, 12:41 AM
Subscribers

Details

Summary

If it encounters an inode whose owner does not have a pw entry, quot
allocates a 7-byte buffer (8 in practice, since that is the minimum
allocation size) and uses it to store the numeric uid preceded by a
hash character. This will overflow the allocated buffer if the UID
exceeds 6 decimal digits. Avoid this by using asprintf() instead.

While here, simplify the common case as well using strdup().

Reported by: Igor Gabriel Sousa e Souza
MFC after: 3 days

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable