From nobody@FreeBSD.ORG Mon Mar 29 02:55:45 1999
Return-Path: <nobody@FreeBSD.ORG>
Received: by hub.freebsd.org (Postfix, from userid 32767)
	id 4C951153C6; Mon, 29 Mar 1999 02:55:45 -0800 (PST)
Message-Id: <19990329105545.4C951153C6@hub.freebsd.org>
Date: Mon, 29 Mar 1999 02:55:45 -0800 (PST)
From: pete@iki.fi
Sender: nobody@FreeBSD.ORG
To: freebsd-gnats-submit@freebsd.org
Subject: Memory allocation bug in usr/bin/strings.c
X-Send-Pr-Version: www-1.0

>Number:         10855
>Category:       bin
>Synopsis:       Memory allocation bug in usr/bin/strings.c
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Mar 29 03:00:01 PST 1999
>Closed-Date:    Mon Mar 29 05:18:22 PST 1999
>Last-Modified:  Mon Mar 29 05:18:34 PST 1999
>Originator:     Petteri Hollnder
>Release:        -
>Organization:
>Environment:
I can see this on FreeBSD 3.0 stable (branches/3.0-stable) branch.

>Description:
Lines 140-142 in the file strings.c (/usr/bin/strings):

        if (!(bfr = malloc((u_int)minlen)))
                errx(1, "malloc");
        bfr[minlen] = '\0';

..at the last line there is obviously a bug, due to the fact that bfr[minlen] does not belong to the malloc'd area?

Obviously this has not been a problem (luck?), but as far as I can tell, the code is broken.

>How-To-Repeat:

>Fix:
Change line 140 in the strings.c from:
        if (!(bfr = malloc((u_int)minlen)))
to:
        if (!(bfr = malloc((u_int)minlen+1)))

=> this should make referencing bfr[minlen] legal..


>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: phk 
State-Changed-When: Mon Mar 29 05:18:22 PST 1999 
State-Changed-Why:  
committed, thanks! 
>Unformatted:
