From stefan@fafoe.narf.at  Sun Dec  7 13:59:59 2003
Return-Path: <stefan@fafoe.narf.at>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 22B4B16A4FC
	for <FreeBSD-gnats-submit@freebsd.org>; Sun,  7 Dec 2003 13:59:59 -0800 (PST)
Received: from fafoe.narf.at (chello212186121237.14.vie.surfer.at [212.186.121.237])
	by mx1.FreeBSD.org (Postfix) with ESMTP id A872A43F85
	for <FreeBSD-gnats-submit@freebsd.org>; Sun,  7 Dec 2003 13:59:57 -0800 (PST)
	(envelope-from stefan@fafoe.narf.at)
Received: from wombat.fafoe.narf.at (wombat.fafoe.narf.at [192.168.1.42])
	by fafoe.narf.at (Postfix) with ESMTP
	id 7BB7740ED; Sun,  7 Dec 2003 22:59:45 +0100 (CET)
Received: by wombat.fafoe.narf.at (Postfix, from userid 1001)
	id 5204C1AC; Sun,  7 Dec 2003 22:59:42 +0100 (CET)
Message-Id: <20031207215942.5204C1AC@wombat.fafoe.narf.at>
Date: Sun,  7 Dec 2003 22:59:42 +0100 (CET)
From: Stefan Farfeleder <stefan@fafoe.narf.at>
Reply-To: Stefan Farfeleder <stefan@fafoe.narf.at>
To: FreeBSD-gnats-submit@freebsd.org
Cc: stefan@fafoe.narf.at
Subject: [patch] Fix typo in malloc() size computation in fdformat.c
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         60026
>Category:       bin
>Synopsis:       [patch] Fix typo in malloc() size computation in fdformat.c
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Dec 07 14:00:37 PST 2003
>Closed-Date:    Tue Jan 06 21:30:03 PST 2004
>Last-Modified:  Tue Jan 06 21:30:03 PST 2004
>Originator:     Stefan Farfeleder
>Release:        FreeBSD 5.2-BETA i386
>Organization:
>Environment:
System: FreeBSD wombat.fafoe.narf.at 5.2-BETA FreeBSD 5.2-BETA #8: Sat Dec 6 18:47:24 CET 2003 stefan@wombat.fafoe.narf.at:/usr/home/stefan/freebsd/obj/usr/home/stefan/freebsd/src/sys/WOMBAT i386

>Description:
In fdformat.c a closing parenthesis is at the wrong place.  Instead of
adding sizeof _PATH_DEV + 1 to the length of argv[optind], the length of the
string starting (sizeof _PATH_DEV + 1) characters after argv[optind]'s
beginning (accessing junk memory if we jump over the terminating null
character) is passed to malloc().

>How-To-Repeat:
n/a

>Fix:
--- fdformat.c.diff begins here ---
Index: src/usr.sbin/fdformat/fdformat.c
===================================================================
RCS file: /usr/home/ncvs/src/usr.sbin/fdformat/fdformat.c,v
retrieving revision 1.20
diff -u -r1.20 fdformat.c
--- src/usr.sbin/fdformat/fdformat.c	1 Apr 2002 21:13:17 -0000	1.20
+++ src/usr.sbin/fdformat/fdformat.c	19 Nov 2003 17:19:55 -0000
@@ -205,7 +205,7 @@
 
 	if (stat(argv[optind], &sb) == -1 && errno == ENOENT) {
 		/* try prepending _PATH_DEV */
-		device = malloc(strlen(argv[optind] + sizeof _PATH_DEV + 1));
+		device = malloc(strlen(argv[optind]) + sizeof _PATH_DEV + 1);
 		if (device == 0)
 			errx(EX_UNAVAILABLE, "out of memory");
 		strcpy(device, _PATH_DEV);
--- fdformat.c.diff ends here ---
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: anholt 
State-Changed-When: Tue Jan 6 21:29:06 PST 2004 
State-Changed-Why:  
Committed, thanks! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=60026 
>Unformatted:
