Page MenuHomeFreeBSD

quot: Fix benign buffer overflow
ClosedPublic

Authored by des on Oct 16 2025, 10:32 AM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Jan 1, 10:58 AM
Unknown Object (File)
Tue, Dec 30, 8:38 AM
Unknown Object (File)
Dec 6 2025, 3:30 AM
Unknown Object (File)
Nov 27 2025, 5:59 PM
Unknown Object (File)
Nov 24 2025, 7:56 PM
Unknown Object (File)
Nov 6 2025, 6:06 PM
Unknown Object (File)
Nov 1 2025, 10:35 AM
Unknown Object (File)
Oct 30 2025, 8:06 AM
Subscribers

Details

Summary

If it encounters an inode whose owner does not have a pw entry, quot
allocates a 7-byte buffer (8 in practice, since that is the minimum
allocation size) and uses it to store the numeric uid preceded by a
hash character. This will overflow the allocated buffer if the UID
exceeds 6 decimal digits. Avoid this by using asprintf() instead.

While here, simplify the common case as well using strdup().

Reported by: Igor Gabriel Sousa e Souza
MFC after: 3 days

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable