Skip to content

Commit

Permalink
Stop writing past the end of buf in the msgget_limit test.
Browse files Browse the repository at this point in the history
There was an extra increment meaning we write to 1 past the end of the
array and not the last item in the array.
  • Loading branch information
zxombie committed Jul 19, 2018
1 parent 5f44eb0 commit 64c25d8
Showing 1 changed file with 12 additions and 1 deletion.
13 changes: 12 additions & 1 deletion contrib/netbsd-tests/lib/libc/sys/t_msgget.c
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,18 @@
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
/*
* CHERI CHANGES START
* {
* "updated": 20180719,
* "target_type": "test",
* "changes": [
* "other"
* ],
* "change_comment": "Fix a buffer overflow by removing an extra i++"
* }
* CHERI CHANGES END
*/
#include <sys/cdefs.h>
__RCSID("$NetBSD: t_msgget.c,v 1.2 2014/02/27 00:59:50 joerg Exp $");

Expand Down Expand Up @@ -239,7 +251,6 @@ ATF_TC_BODY(msgget_limit, tc)
}
}

i++;
errno = 0;

buf[i] = msgget(MSG_KEY + i, IPC_CREAT | IPC_EXCL | 0600);
Expand Down

0 comments on commit 64c25d8

Please sign in to comment.