Fix an out-of-bounds write when a zero-length buffer is passed.
ClosedPublic
Actions

Authored by brooks on Apr 12 2017, 10:57 PM.

Tags

None

Referenced Files

	Unknown Object (File)
	Wed, Apr 15, 7:45 PM

	Unknown Object (File)
	Mon, Apr 13, 2:29 AM

	Unknown Object (File)
	Sun, Apr 12, 7:32 PM

	Unknown Object (File)
	Sat, Apr 11, 11:39 PM

	Unknown Object (File)
	Sat, Apr 11, 5:58 AM

	Unknown Object (File)
	Fri, Apr 10, 11:41 AM

	Unknown Object (File)
	Tue, Apr 7, 7:37 AM

	Unknown Object (File)
	Tue, Mar 31, 9:52 PM

View All 76 Files

Subscribers

None

Details

Reviewers

jilles
jhb
emaste

Commits

rS316768: Fix an out-of-bounds write when a zero-length buffer is passed.

Summary

Found with ttyname_test and CHERI bounds checking.

Sponsored by: DARPA, AFRL
Obtained from: CheriBSD

Diff Detail

Lint

Lint Passed

Unit

No Test Coverage

Build Status

Buildable 8705
Build 9040: arc lint + arc unit

Event Timeline

brooks created this revision.Apr 12 2017, 10:57 PM

Harbormaster completed remote builds in B8705: Diff 27390.Apr 12 2017, 10:57 PM

I also wonder if we should perform a NULL pointer check, but POSIX doesn't explicitly allow EINVAL.

emaste accepted this revision.Apr 12 2017, 11:10 PM

This revision is now accepted and ready to land.Apr 12 2017, 11:10 PM

In D10377#214967, @brooks wrote:

I also wonder if we should perform a NULL pointer check, but POSIX doesn't explicitly allow EINVAL.

Bruce would argue that a SIGSEGV is a valid NULL pointer check. That is the failure case for many other APIs in userland (e.g. strlen() and strcpy()).

Closed by commit rS316768: Fix an out-of-bounds write when a zero-length buffer is passed. (authored by brooks). · Explain WhyApr 13 2017, 3:52 PM

This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

Path

Size

lib/

libc/

gen/

ttyname.c

4 lines

Diff 27390

View Options

Fix an out-of-bounds write when a zero-length buffer is passed.ClosedPublicActions