From mfp49_freebsd@plass-family.net  Thu Dec 27 22:59:54 2007
Return-Path: <mfp49_freebsd@plass-family.net>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 81F8316A419
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 27 Dec 2007 22:59:54 +0000 (UTC)
	(envelope-from mfp49_freebsd@plass-family.net)
Received: from plass-family.net (adsl-68-127-22-237.dsl.pltn13.pacbell.net [68.127.22.237])
	by mx1.freebsd.org (Postfix) with ESMTP id 6773F13C45A
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 27 Dec 2007 22:59:54 +0000 (UTC)
	(envelope-from mfp49_freebsd@plass-family.net)
Received: from nat.plass-family.net (nat.plass-family.net [68.127.22.235])
	by plass-family.net (Postfix) with ESMTP id 5308222858;
	Thu, 27 Dec 2007 14:48:07 -0800 (PST)
Received: by shuttle.plass-family.net (Postfix, from userid 3076)
	id 40C8F1702A; Thu, 27 Dec 2007 14:48:07 -0800 (PST)
Message-Id: <20071227224807.40C8F1702A@shuttle.plass-family.net>
Date: Thu, 27 Dec 2007 14:48:07 -0800 (PST)
From: Michael Plass <mfp49_freebsd@plass-family.net>
Reply-To: Michael Plass <mfp49_freebsd@plass-family.net>
To: FreeBSD-gnats-submit@freebsd.org
Cc: mfp49_freebsd@plass-family.net 
Subject: [patch] DDB input routine reads/writes beyond end of buffer
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         119079
>Category:       kern
>Synopsis:       [patch] DDB input routine reads/writes beyond end of buffer
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    rwatson
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Dec 27 23:00:09 UTC 2007
>Closed-Date:    Mon Mar 10 10:37:43 UTC 2008
>Last-Modified:  Mon Mar 10 10:37:43 UTC 2008
>Originator:     Michael Plass
>Release:        FreeBSD 7.0-PRERELEASE amd64
>Organization:
PARC
>Environment:
System: FreeBSD shuttle.plass-family.net 7.0-PRERELEASE FreeBSD 7.0-PRERELEASE #20: Thu Dec 27 13:31:57 PST 2007 root@shuttle.plass-family.net:/usr/obj/usr/src/sys/FASTGENERIC amd64
>Description:
	The ddb input routine db_readline() includes the terminating newline
	and NUL characters in the returned buffer, but it does not take this
	into account when checking against the caller-supplied limit.
>How-To-Repeat:
	Enter DDB and type enough characters to fill the buffer
	(120 characters).  Hit enter, and then use the up-arrow key to
	scroll back through history.  Note that it picks up garbage past the
	end of the original line.
>Fix:
	The patch checks the provided lsize and decreases by two to leave
	room for the newline and NUL; it also clears these two characters,
	because some of the code paths don't provide the terminating NUL.
	(The patch also corrects a problem in history redraw when the cursor
	is not at the end of the line while scrolling back though history.)

--- db_input_bufoverflow.patch begins here ---
Index: db_input.c
===================================================================
RCS file: /home/ncvs/src/sys/ddb/db_input.c,v
retrieving revision 1.37
diff -u -3 -r1.37 db_input.c
--- db_input.c	25 Dec 2007 23:06:51 -0000	1.37
+++ db_input.c	27 Dec 2007 22:04:40 -0000
@@ -250,7 +250,7 @@
 		}
 
 	    hist_redraw:
-		db_putnchars(BACKUP, db_le - db_lbuf_start);
+		db_putnchars(BACKUP, db_lc - db_lbuf_start);
 		db_putnchars(BLANK, db_le - db_lbuf_start);
 		db_putnchars(BACKUP, db_le - db_lbuf_start);
 		db_le = index(db_lbuf_start, '\0');
@@ -302,6 +302,10 @@
 	char *	lstart;
 	int	lsize;
 {
+	if (lsize < 3)
+		return (0);
+	lstart[lsize - 1] = lstart[lsize - 2] = 0;
+	lsize -= 2;	/* allow space for newline and terminating NUL */
 	if (lsize != db_lhistlsize) {
 		/*
 		 * (Re)initialize input line history.  Throw away any
--- db_input_bufoverflow.patch ends here ---


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->rwatson 
Responsible-Changed-By: remko 
Responsible-Changed-When: Fri Dec 28 07:29:38 UTC 2007 
Responsible-Changed-Why:  
Hi Robert, you recently worked in this area, can you please 
have a look at this? 

http://www.freebsd.org/cgi/query-pr.cgi?pr=119079 

From: Robert Watson <rwatson@FreeBSD.org>
To: Michael Plass <mfp49_freebsd@plass-family.net>
Cc: FreeBSD-gnats-submit@FreeBSD.org, freebsd-bugs@FreeBSD.org
Subject: Re: kern/119079: [patch] DDB input routine reads/writes beyond end
 of	buffer
Date: Thu, 6 Mar 2008 10:01:27 +0000 (GMT)

 On Thu, 27 Dec 2007, Michael Plass wrote:
 
 >> Description:
 > 	The ddb input routine db_readline() includes the terminating newline
 > 	and NUL characters in the returned buffer, but it does not take this
 > 	into account when checking against the caller-supplied limit.
 >> How-To-Repeat:
 > 	Enter DDB and type enough characters to fill the buffer
 > 	(120 characters).  Hit enter, and then use the up-arrow key to
 > 	scroll back through history.  Note that it picks up garbage past the
 > 	end of the original line.
 >> Fix:
 > 	The patch checks the provided lsize and decreases by two to leave
 > 	room for the newline and NUL; it also clears these two characters,
 > 	because some of the code paths don't provide the terminating NUL.
 > 	(The patch also corrects a problem in history redraw when the cursor
 > 	is not at the end of the line while scrolling back though history.)
 
 Dear Michael,
 
 Thanks for this report; I'm able to reproduce both problems, and am currently 
 looking at your patch.  I'm going to immediately commit the redraw fix, but 
 did have one question about the remainder of the patch below.
 
 > @@ -302,6 +302,10 @@
 > 	char *	lstart;
 > 	int	lsize;
 > {
 > +	if (lsize < 3)
 > +		return (0);
 > +	lstart[lsize - 1] = lstart[lsize - 2] = 0;
 > +	lsize -= 2;	/* allow space for newline and terminating NUL */
 
 You comment that you need to leave room for two bytes here -- terminating 
 newline and nul.  Could you clarify in what cases the NL may be missing?  It 
 looks to me like the loop around db_inputchar() effectively ensures that we 
 never leave that loop without the buffer containing an NL, and that the NL 
 should fit in the buffer.  I concur on the nul termination reading.  So my 
 question is: is it not sufficient to simply do the following:
 
  	lstart[lsize - 1] = 0;
  	lsize--;
 
 Thanks,
 
 Robert N M Watson
 Computer Laboratory
 University of Cambridge
 
 > 	if (lsize != db_lhistlsize) {
 > 		/*
 > 		 * (Re)initialize input line history.  Throw away any
 > --- db_input_bufoverflow.patch ends here ---
 >
 >
 >> Release-Note:
 >> Audit-Trail:
 >> Unformatted:
 > _______________________________________________
 > freebsd-bugs@freebsd.org mailing list
 > http://lists.freebsd.org/mailman/listinfo/freebsd-bugs
 > To unsubscribe, send any mail to "freebsd-bugs-unsubscribe@freebsd.org"
 >

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/119079: commit references a PR
Date: Thu,  6 Mar 2008 10:10:52 +0000 (UTC)

 rwatson     2008-03-06 10:10:44 UTC
 
   FreeBSD src repository
 
   Modified files:
     sys/ddb              db_input.c 
   Log:
   When redrawing an input line, count backspaces to get to the beginning of
   the input field from the current cursor location, rather than the end of
   the input line, as the cursor may not be at the end of the line.
   Otherwise, we may overshoot, overwriting a bit of the previous line and
   failing to fully overwrite the current line.
   
   MFC after:      3 days
   PR:             119079
   Submitted by:   Michael Plass <mfp49_freebsd@plass-family.net>
   
   Revision  Changes    Path
   1.38      +1 -1      src/sys/ddb/db_input.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: open->patched 
State-Changed-By: rwatson 
State-Changed-When: Thu Mar 6 10:23:31 UTC 2008 
State-Changed-Why:  
First portion of patch has been committed, so transition to patched state. 
I'll MFC that in a few days, but will also get the other portion resolved 
before closing. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=119079 

From: Michael Plass <mfp49_freebsd@plass-family.net>
To: Robert Watson <rwatson@FreeBSD.org>
Cc: Michael Plass <mfp49_freebsd@plass-family.net>,
 FreeBSD-gnats-submit@FreeBSD.org,
 freebsd-bugs@FreeBSD.org
Subject: Re: kern/119079: [patch] DDB input routine reads/writes beyond end of	buffer
Date: Thu, 6 Mar 2008 22:38:56 -0800

 On Mar 6, 2008, at 2:01 AM, Robert Watson wrote:
 
 >
 > On Thu, 27 Dec 2007, Michael Plass wrote:
 >
 >>> Description:
 >> 	The ddb input routine db_readline() includes the terminating newline
 >> 	and NUL characters in the returned buffer, but it does not take this
 >> 	into account when checking against the caller-supplied limit.
 >>> How-To-Repeat:
 >> 	Enter DDB and type enough characters to fill the buffer
 >> 	(120 characters).  Hit enter, and then use the up-arrow key to
 >> 	scroll back through history.  Note that it picks up garbage past the
 >> 	end of the original line.
 >>> Fix:
 >> 	The patch checks the provided lsize and decreases by two to leave
 >> 	room for the newline and NUL; it also clears these two characters,
 >> 	because some of the code paths don't provide the terminating NUL.
 >> 	(The patch also corrects a problem in history redraw when the cursor
 >> 	is not at the end of the line while scrolling back though history.)
 >
 > Dear Michael,
 >
 > Thanks for this report; I'm able to reproduce both problems, and am  
 > currently looking at your patch.  I'm going to immediately commit  
 > the redraw fix, but did have one question about the remainder of  
 > the patch below.
 >
 >> @@ -302,6 +302,10 @@
 >> 	char *	lstart;
 >> 	int	lsize;
 >> {
 >> +	if (lsize < 3)
 >> +		return (0);
 >> +	lstart[lsize - 1] = lstart[lsize - 2] = 0;
 >> +	lsize -= 2;	/* allow space for newline and terminating NUL */
 >
 > You comment that you need to leave room for two bytes here --  
 > terminating newline and nul.  Could you clarify in what cases the  
 > NL may be missing?  It looks to me like the loop around db_inputchar 
 > () effectively ensures that we never leave that loop without the  
 > buffer containing an NL, and that the NL should fit in the buffer.   
 > I concur on the nul termination reading.  So my question is: is it  
 > not sufficient to simply do the following:
 >
 > 	lstart[lsize - 1] = 0;
 > 	lsize--;
 >
 > Thanks,
 >
 > Robert N M Watson
 > Computer Laboratory
 > University of Cambridge
 >
 >> 	if (lsize != db_lhistlsize) {
 >> 		/*
 >> 		 * (Re)initialize input line history.  Throw away any
 >> --- db_input_bufoverflow.patch ends here ---
 >>
 >>
 >>> Release-Note:
 >>> Audit-Trail:
 >>> Unformatted:
 >> _______________________________________________
 >> freebsd-bugs@freebsd.org mailing list
 >> http://lists.freebsd.org/mailman/listinfo/freebsd-bugs
 >> To unsubscribe, send any mail to "freebsd-bugs- 
 >> unsubscribe@freebsd.org"
 >>
 
 Robert,
 
 I was able to reproduce the problem in a version rigged to run in  
 userspace.
 Check what happens when you just type enough to fill the buffer (or  
 until it
 beeps) and then hit return.  The normal chars are handled in the  
 default case
 of the big switch in db_inputchar(), and when the buffer is
 full (db_le == db_lbuf_end), db_inputchar() returns 0.  The driving  
 loop calls
 again, this time with the newline, and that gets stored this way:
 	    case '\n':
 		/* FALLTHROUGH */
 	    case '\r':
 		*db_le++ = c;
 		return (1);
 leaving the newline in db_lbuf_end[0] and db_le == db_lbuf_end + 1,  
 so that the terminating nul is stored at db_lbuf_end[1].
 
 I've only lightly tested it, but upon reexamination I think better fix
 is to leave lsize alone in do_readline() and initialize
     db_lbuf_end = lstart + lsize - 2;
 this will assure that each of the lines in the history buffer have  
 proper
 termination and storing the nul in the initialization won't be needed.
 
 The patch against 1.38 then looks like this:
 --- db_input.c.orig	2008-03-06 22:09:04.000000000 -0800
 +++ db_input.c	2008-03-06 22:25:24.000000000 -0800
 @@ -302,6 +302,8 @@
   	char *	lstart;
   	int	lsize;
   {
 +	if (lsize < 2)
 +		return(0);
   	if (lsize != db_lhistlsize) {
   		/*
   		 * (Re)initialize input line history.  Throw away any
 @@ -316,7 +318,7 @@
   	db_force_whitespace();	/* synch output position */
 
   	db_lbuf_start = lstart;
 -	db_lbuf_end   = lstart + lsize;
 +	db_lbuf_end   = lstart + lsize - 2;
   	db_lc = lstart;
   	db_le = lstart;
 
 
 Thanks for the care you've taken in committing this.
 - Michael
 
 
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/119079: commit references a PR
Date: Fri,  7 Mar 2008 13:13:27 +0000 (UTC)

 rwatson     2008-03-07 13:13:18 UTC
 
   FreeBSD src repository
 
   Modified files:
     sys/ddb              db_input.c 
   Log:
   Reserve two bytes at the end of the DDB input line in db_readline() to
   hold the newline and nul terminator.  Otherwise, there are cases where
   garbage may end up in the command history due to a lack of a nul
   terminator, or input may end up without room for a newline.
   
   MFC after:      3 days
   PR:             119079
   Submitted by:   Michael Plass <mfp49_freebsd@plass-family.net>
   
   Revision  Changes    Path
   1.39      +4 -1      src/sys/ddb/db_input.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 

From: Robert Watson <rwatson@FreeBSD.org>
To: Michael Plass <mfp49_freebsd@plass-family.net>
Cc: FreeBSD-gnats-submit@FreeBSD.org, freebsd-bugs@FreeBSD.org
Subject: Re: kern/119079: [patch] DDB input routine reads/writes beyond end
 of	buffer
Date: Fri, 7 Mar 2008 13:14:00 +0000 (GMT)

 On Thu, 6 Mar 2008, Michael Plass wrote:
 
 > I was able to reproduce the problem in a version rigged to run in userspace. 
 > Check what happens when you just type enough to fill the buffer (or until it 
 > beeps) and then hit return.  The normal chars are handled in the default 
 > case of the big switch in db_inputchar(), and when the buffer is full (db_le 
 > == db_lbuf_end), db_inputchar() returns 0.  The driving loop calls again, 
 > this time with the newline, and that gets stored this way:
 > 	    case '\n':
 > 		/* FALLTHROUGH */
 > 	    case '\r':
 > 		*db_le++ = c;
 > 		return (1); leaving the newline in db_lbuf_end[0] and db_le == 
 > db_lbuf_end + 1, so that the terminating nul is stored at db_lbuf_end[1].
 >
 > I've only lightly tested it, but upon reexamination I think better fix is to 
 > leave lsize alone in do_readline() and initialize
 >  db_lbuf_end = lstart + lsize - 2; this will assure that each of the lines 
 > in the history buffer have proper termination and storing the nul in the 
 > initialization won't be needed.
 
 Ah, indeed.  I like the revised fix better also.  I've gone ahead and 
 committed the revised patch and will MFC it in a few days.  Thanks for the 
 report/fixes!
 
 Robert N M Watson
 Computer Laboratory
 University of Cambridge
 
 >
 > The patch against 1.38 then looks like this:
 > --- db_input.c.orig	2008-03-06 22:09:04.000000000 -0800
 > +++ db_input.c	2008-03-06 22:25:24.000000000 -0800
 > @@ -302,6 +302,8 @@
 > 	char *	lstart;
 > 	int	lsize;
 > {
 > +	if (lsize < 2)
 > +		return(0);
 > 	if (lsize != db_lhistlsize) {
 > 		/*
 > 		 * (Re)initialize input line history.  Throw away any
 > @@ -316,7 +318,7 @@
 > 	db_force_whitespace();	/* synch output position */
 >
 > 	db_lbuf_start = lstart;
 > -	db_lbuf_end   = lstart + lsize;
 > +	db_lbuf_end   = lstart + lsize - 2;
 > 	db_lc = lstart;
 > 	db_le = lstart;
 >
 >
 > Thanks for the care you've taken in committing this.
 > - Michael
 >
 >
 >

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/119079: commit references a PR
Date: Sun,  9 Mar 2008 14:49:44 +0000 (UTC)

 rwatson     2008-03-09 14:49:39 UTC
 
   FreeBSD src repository
 
   Modified files:        (Branch: RELENG_7)
     sys/ddb              db_input.c 
   Log:
   Merge db_input.c:1.38 from HEAD to RELENG_7:
   
     When redrawing an input line, count backspaces to get to the beginning of
     the input field from the current cursor location, rather than the end of
     the input line, as the cursor may not be at the end of the line.
     Otherwise, we may overshoot, overwriting a bit of the previous line and
     failing to fully overwrite the current line.
   
     PR:             119079
     Submitted by:   Michael Plass <mfp49_freebsd@plass-family.net>
   
   Revision   Changes    Path
   1.36.10.1  +1 -1      src/sys/ddb/db_input.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/119079: commit references a PR
Date: Sun,  9 Mar 2008 14:50:34 +0000 (UTC)

 rwatson     2008-03-09 14:50:28 UTC
 
   FreeBSD src repository
 
   Modified files:        (Branch: RELENG_6)
     sys/ddb              db_input.c 
   Log:
   Merge db_input.c:1.38 from HEAD to RELENG_6:
   
     When redrawing an input line, count backspaces to get to the beginning of
     the input field from the current cursor location, rather than the end of
     the input line, as the cursor may not be at the end of the line.
     Otherwise, we may overshoot, overwriting a bit of the previous line and
     failing to fully overwrite the current line.
   
     PR:             119079
     Submitted by:   Michael Plass <mfp49_freebsd@plass-family.net>
   
   Revision  Changes    Path
   1.36.2.1  +1 -1      src/sys/ddb/db_input.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/119079: commit references a PR
Date: Sun,  9 Mar 2008 14:55:12 +0000 (UTC)

 rwatson     2008-03-09 14:55:00 UTC
 
   FreeBSD src repository
 
   Modified files:        (Branch: RELENG_5)
     sys/ddb              db_input.c 
   Log:
   Merge db_input.c:1.38 from HEAD to RELENG_5:
   
     When redrawing an input line, count backspaces to get to the beginning of
     the input field from the current cursor location, rather than the end of
     the input line, as the cursor may not be at the end of the line.
     Otherwise, we may overshoot, overwriting a bit of the previous line and
     failing to fully overwrite the current line.
   
     PR:             119079
     Submitted by:   Michael Plass <mfp49_freebsd@plass-family.net>
   
   Revision  Changes    Path
   1.35.4.2  +1 -1      src/sys/ddb/db_input.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/119079: commit references a PR
Date: Mon, 10 Mar 2008 10:23:08 +0000 (UTC)

 rwatson     2008-03-10 10:23:03 UTC
 
   FreeBSD src repository
 
   Modified files:        (Branch: RELENG_7)
     sys/ddb              db_input.c 
   Log:
   Merge db_input.c:1.39 from HEAD to RELENG_7:
   
     Reserve two bytes at the end of the DDB input line in db_readline() to
     hold the newline and nul terminator.  Otherwise, there are cases where
     garbage may end up in the command history due to a lack of a nul
     terminator, or input may end up without room for a newline.
   
     PR:             119079
     Submitted by:   Michael Plass <mfp49_freebsd@plass-family.net>
   
   Revision   Changes    Path
   1.36.10.2  +4 -1      src/sys/ddb/db_input.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/119079: commit references a PR
Date: Mon, 10 Mar 2008 10:23:44 +0000 (UTC)

 rwatson     2008-03-10 10:23:37 UTC
 
   FreeBSD src repository
 
   Modified files:        (Branch: RELENG_6)
     sys/ddb              db_input.c 
   Log:
   Merge db_input.c:1.39 from HEAD to RELENG_6:
   
     Reserve two bytes at the end of the DDB input line in db_readline() to
     hold the newline and nul terminator.  Otherwise, there are cases where
     garbage may end up in the command history due to a lack of a nul
     terminator, or input may end up without room for a newline.
   
     PR:             119079
     Submitted by:   Michael Plass <mfp49_freebsd@plass-family.net>
   
   Revision  Changes    Path
   1.36.2.2  +4 -1      src/sys/ddb/db_input.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/119079: commit references a PR
Date: Mon, 10 Mar 2008 10:24:20 +0000 (UTC)

 rwatson     2008-03-10 10:24:12 UTC
 
   FreeBSD src repository
 
   Modified files:        (Branch: RELENG_5)
     sys/ddb              db_input.c 
   Log:
   Merge db_input.c:1.39 from HEAD to RELENG_5:
   
     Reserve two bytes at the end of the DDB input line in db_readline() to
     hold the newline and nul terminator.  Otherwise, there are cases where
     garbage may end up in the command history due to a lack of a nul
     terminator, or input may end up without room for a newline.
   
     PR:             119079
     Submitted by:   Michael Plass <mfp49_freebsd@plass-family.net>
   
   Revision  Changes    Path
   1.35.4.3  +4 -1      src/sys/ddb/db_input.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: patched->closed 
State-Changed-By: rwatson 
State-Changed-When: Mon Mar 10 10:37:09 UTC 2008 
State-Changed-Why:  
Both changes are now MFC'd to 5.x - 7.x; thanks for the submission! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=119079 
>Unformatted:
