Page MenuHomeFreeBSD

quot: Fix benign buffer overflow
ClosedPublic

Authored by des on Oct 16 2025, 10:32 AM.
Tags
None
Referenced Files
F176602371: D53129.id164397.diff
Tue, Oct 20, 3:52 AM
F176599312: D53129.id164280.diff
Tue, Oct 20, 3:16 AM
Unknown Object (File)
Fri, Oct 16, 9:30 PM
Unknown Object (File)
Fri, Oct 9, 5:00 PM
Unknown Object (File)
Fri, Oct 9, 4:59 PM
Unknown Object (File)
Fri, Oct 9, 4:08 PM
Unknown Object (File)
Thu, Oct 8, 2:24 PM
Unknown Object (File)
Tue, Oct 6, 5:17 AM
Subscribers

Details

Summary

If it encounters an inode whose owner does not have a pw entry, quot
allocates a 7-byte buffer (8 in practice, since that is the minimum
allocation size) and uses it to store the numeric uid preceded by a
hash character. This will overflow the allocated buffer if the UID
exceeds 6 decimal digits. Avoid this by using asprintf() instead.

While here, simplify the common case as well using strdup().

Reported by: Igor Gabriel Sousa e Souza
MFC after: 3 days

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable