From marka@drugs.dv.isc.org  Tue May 21 23:13:17 2002
Return-Path: <marka@drugs.dv.isc.org>
Received: from drugs.dv.isc.org (drugs.dv.isc.org [130.155.191.236])
	by hub.freebsd.org (Postfix) with ESMTP id 0605C37B40B
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 21 May 2002 23:13:16 -0700 (PDT)
Received: from drugs.dv.isc.org (localhost.dv.isc.org [127.0.0.1])
	by drugs.dv.isc.org (8.12.3/8.12.3) with ESMTP id g4M6DCOI050937
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 22 May 2002 16:13:12 +1000 (EST)
	(envelope-from marka@drugs.dv.isc.org)
Received: (from marka@localhost)
	by drugs.dv.isc.org (8.12.3/8.12.3/Submit) id g4M6DCMY050936;
	Wed, 22 May 2002 16:13:12 +1000 (EST)
Message-Id: <200205220613.g4M6DCMY050936@drugs.dv.isc.org>
Date: Wed, 22 May 2002 16:13:12 +1000 (EST)
From: Mark Andrews <marka@isc.org>
Reply-To: Mark Andrews <marka@isc.org>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: buffer underrun in mkstemp().
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         38402
>Category:       bin
>Synopsis:       buffer underrun in mkstemp().
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue May 21 23:20:01 PDT 2002
>Closed-Date:    Thu May 23 07:34:34 PDT 2002
>Last-Modified:  Thu May 23 07:34:34 PDT 2002
>Originator:     Mark Andrews
>Release:        FreeBSD 4.6-RC i386
>Organization:
ISC
>Environment:
System: FreeBSD drugs.dv.isc.org 4.6-RC FreeBSD 4.6-RC #5: Sat May 18 12:54:10 EST 2002 marka@drugs.dv.isc.org:/usr/obj/usr/src/sys/DRUGS i386


>Description:

	mkstemp() etc. will underrun the template buffer.

>How-To-Repeat:

main() {
	int s; char buf1[30];

	strcpy(buf1, "XXXXXXX");
	s = mkstemp(buf1+2);
	printf("%s\n", buf1);
}

	The first two character should be X.  You may need to repeat
	depending upon the random characters selected.

>Fix:


Index: mktemp.c
===================================================================
RCS file: /home/ncvs/src/lib/libc/stdio/mktemp.c,v
retrieving revision 1.19.2.1
diff -u -r1.19.2.1 mktemp.c
--- mktemp.c	2001/01/20 09:35:24	1.19.2.1
+++ mktemp.c	2002/05/22 06:06:55
@@ -128,7 +128,7 @@
 	}
 
 	/* Fill space with random characters */
-	while (*trv == 'X') {
+	while (*trv == 'X' && trv >= path) {
 		rand = arc4random() % (sizeof(padchar) - 1);
 		*trv-- = padchar[rand];
 	}
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: robert 
State-Changed-When: Thu May 23 07:32:32 PDT 2002 
State-Changed-Why:  
Committed, thank you! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=38402 
>Unformatted:
