The size of the containint structure was passed instead of the size of
the array. This happened to be harmless as the extra word copied is
one we copy in the next line anyway.
Obtained from: CheriBSD
Details
Details
- using CHERI in the kernel on RISC-V found this buffer overflow since the pointer passed to memcpy had bounds on the array, not the containing structure
Diff Detail
Diff Detail
- Repository
- rS FreeBSD src repository - subversion
- Lint
Lint Passed - Unit
No Test Coverage - Build Status
Buildable 32517 Build 29989: arc lint + arc unit